CWE-1341
AllowedMultiple Releases of Same Resource or Handle
Abstraction: Base · Status: Incomplete
The product attempts to close or release a resource or handle more than once, without any successful open between the close operations.
11 vulnerabilities reference this CWE, most recent first.
GHSA-497X-JCXF-M478
Vulnerability from github – Published: 2026-05-07 21:30 – Updated: 2026-07-15 03:32When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.
{
"affected": [],
"aliases": [
"CVE-2026-33811"
],
"database_specific": {
"cwe_ids": [
"CWE-1341",
"CWE-415"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-07T20:16:42Z",
"severity": "HIGH"
},
"details": "When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.",
"id": "GHSA-497x-jcxf-m478",
"modified": "2026-07-15T03:32:20Z",
"published": "2026-05-07T21:30:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33811"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:23262"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:36648"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:36651"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:36776"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:36796"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:36797"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:38504"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:39266"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:39272"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:39319"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-33811"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467822"
},
{
"type": "WEB",
"url": "https://go.dev/cl/767860"
},
{
"type": "WEB",
"url": "https://go.dev/issue/78803"
},
{
"type": "WEB",
"url": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M"
},
{
"type": "WEB",
"url": "https://pkg.go.dev/vuln/GO-2026-4981"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33811.json"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:23264"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:33120"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:33123"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:33142"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:33150"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:33574"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:34357"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:34359"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:34364"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:35832"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:35993"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:35994"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:35995"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:36207"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:36319"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:36617"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:36625"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-527M-87RR-P4RJ
Vulnerability from github – Published: 2026-05-27 15:33 – Updated: 2026-06-30 03:36In the Linux kernel, the following vulnerability has been resolved:
RDMA/iwcm: Fix workqueue list corruption by removing work_list
The commit e1168f0 ("RDMA/iwcm: Simplify cm_event_handler()") changed the work submission logic to unconditionally call queue_work() with the expectation that queue_work() would have no effect if work was already pending. The problem is that a free list of struct iwcm_work is used (for which struct work_struct is embedded), so each call to queue_work() is basically unique and therefore does indeed queue the work.
This causes a problem in the work handler which walks the work_list until it's empty to process entries. This means that a single run of the work handler could process item N+1 and release it back to the free list while the actual workqueue entry is still queued. It could then get reused (INIT_WORK...) and lead to list corruption in the workqueue logic.
Fix this by just removing the work_list. The workqueue already does this for us.
This fixes the following error that was observed when stress testing with ucmatose on an Intel E830 in iWARP mode:
[ 151.465780] list_del corruption. next->prev should be ffff9f0915c69c08, but was ffff9f0a1116be08. (next=ffff9f0a15b11c08) [ 151.466639] ------------[ cut here ]------------ [ 151.466986] kernel BUG at lib/list_debug.c:67! [ 151.467349] Oops: invalid opcode: 0000 [#1] SMP NOPTI [ 151.467753] CPU: 14 UID: 0 PID: 2306 Comm: kworker/u64:18 Not tainted 6.19.0-rc4+ #1 PREEMPT(voluntary) [ 151.468466] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 151.469192] Workqueue: 0x0 (iw_cm_wq) [ 151.469478] RIP: 0010:__list_del_entry_valid_or_report+0xf0/0x100 [ 151.469942] Code: c7 58 5f 4c b2 e8 10 50 aa ff 0f 0b 48 89 ef e8 36 57 cb ff 48 8b 55 08 48 89 e9 48 89 de 48 c7 c7 a8 5f 4c b2 e8 f0 4f aa ff <0f> 0b 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 90 90 90 90 90 90 [ 151.471323] RSP: 0000:ffffb15644e7bd68 EFLAGS: 00010046 [ 151.471712] RAX: 000000000000006d RBX: ffff9f0915c69c08 RCX: 0000000000000027 [ 151.472243] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff9f0a37d9c600 [ 151.472768] RBP: ffff9f0a15b11c08 R08: 0000000000000000 R09: c0000000ffff7fff [ 151.473294] R10: 0000000000000001 R11: ffffb15644e7bba8 R12: ffff9f092339ee68 [ 151.473817] R13: ffff9f0900059c28 R14: ffff9f092339ee78 R15: 0000000000000000 [ 151.474344] FS: 0000000000000000(0000) GS:ffff9f0a847b5000(0000) knlGS:0000000000000000 [ 151.474934] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 151.475362] CR2: 0000559e233a9088 CR3: 000000020296b004 CR4: 0000000000770ef0 [ 151.475895] PKRU: 55555554 [ 151.476118] Call Trace: [ 151.476331] [ 151.476497] move_linked_works+0x49/0xa0 [ 151.476792] __pwq_activate_work.isra.46+0x2f/0xa0 [ 151.477151] pwq_dec_nr_in_flight+0x1e0/0x2f0 [ 151.477479] process_scheduled_works+0x1c8/0x410 [ 151.477823] worker_thread+0x125/0x260 [ 151.478108] ? __pfx_worker_thread+0x10/0x10 [ 151.478430] kthread+0xfe/0x240 [ 151.478671] ? __pfx_kthread+0x10/0x10 [ 151.478955] ? __pfx_kthread+0x10/0x10 [ 151.479240] ret_from_fork+0x208/0x270 [ 151.479523] ? __pfx_kthread+0x10/0x10 [ 151.479806] ret_from_fork_asm+0x1a/0x30 [ 151.480103]
{
"affected": [],
"aliases": [
"CVE-2026-45898"
],
"database_specific": {
"cwe_ids": [
"CWE-1341"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-27T14:17:04Z",
"severity": "CRITICAL"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/iwcm: Fix workqueue list corruption by removing work_list\n\nThe commit e1168f0 (\"RDMA/iwcm: Simplify cm_event_handler()\")\nchanged the work submission logic to unconditionally call\nqueue_work() with the expectation that queue_work() would\nhave no effect if work was already pending. The problem is\nthat a free list of struct iwcm_work is used (for which\nstruct work_struct is embedded), so each call to queue_work()\nis basically unique and therefore does indeed queue the work.\n\nThis causes a problem in the work handler which walks the work_list\nuntil it\u0027s empty to process entries. This means that a single\nrun of the work handler could process item N+1 and release it\nback to the free list while the actual workqueue entry is still\nqueued. It could then get reused (INIT_WORK...) and lead to\nlist corruption in the workqueue logic.\n\nFix this by just removing the work_list. The workqueue already\ndoes this for us.\n\nThis fixes the following error that was observed when stress\ntesting with ucmatose on an Intel E830 in iWARP mode:\n\n[ 151.465780] list_del corruption. next-\u003eprev should be ffff9f0915c69c08, but was ffff9f0a1116be08. (next=ffff9f0a15b11c08)\n[ 151.466639] ------------[ cut here ]------------\n[ 151.466986] kernel BUG at lib/list_debug.c:67!\n[ 151.467349] Oops: invalid opcode: 0000 [#1] SMP NOPTI\n[ 151.467753] CPU: 14 UID: 0 PID: 2306 Comm: kworker/u64:18 Not tainted 6.19.0-rc4+ #1 PREEMPT(voluntary)\n[ 151.468466] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n[ 151.469192] Workqueue: 0x0 (iw_cm_wq)\n[ 151.469478] RIP: 0010:__list_del_entry_valid_or_report+0xf0/0x100\n[ 151.469942] Code: c7 58 5f 4c b2 e8 10 50 aa ff 0f 0b 48 89 ef e8 36 57 cb ff 48 8b 55 08 48 89 e9 48 89 de 48 c7 c7 a8 5f 4c b2 e8 f0 4f aa ff \u003c0f\u003e 0b 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 90 90 90 90 90 90\n[ 151.471323] RSP: 0000:ffffb15644e7bd68 EFLAGS: 00010046\n[ 151.471712] RAX: 000000000000006d RBX: ffff9f0915c69c08 RCX: 0000000000000027\n[ 151.472243] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff9f0a37d9c600\n[ 151.472768] RBP: ffff9f0a15b11c08 R08: 0000000000000000 R09: c0000000ffff7fff\n[ 151.473294] R10: 0000000000000001 R11: ffffb15644e7bba8 R12: ffff9f092339ee68\n[ 151.473817] R13: ffff9f0900059c28 R14: ffff9f092339ee78 R15: 0000000000000000\n[ 151.474344] FS: 0000000000000000(0000) GS:ffff9f0a847b5000(0000) knlGS:0000000000000000\n[ 151.474934] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 151.475362] CR2: 0000559e233a9088 CR3: 000000020296b004 CR4: 0000000000770ef0\n[ 151.475895] PKRU: 55555554\n[ 151.476118] Call Trace:\n[ 151.476331] \u003cTASK\u003e\n[ 151.476497] move_linked_works+0x49/0xa0\n[ 151.476792] __pwq_activate_work.isra.46+0x2f/0xa0\n[ 151.477151] pwq_dec_nr_in_flight+0x1e0/0x2f0\n[ 151.477479] process_scheduled_works+0x1c8/0x410\n[ 151.477823] worker_thread+0x125/0x260\n[ 151.478108] ? __pfx_worker_thread+0x10/0x10\n[ 151.478430] kthread+0xfe/0x240\n[ 151.478671] ? __pfx_kthread+0x10/0x10\n[ 151.478955] ? __pfx_kthread+0x10/0x10\n[ 151.479240] ret_from_fork+0x208/0x270\n[ 151.479523] ? __pfx_kthread+0x10/0x10\n[ 151.479806] ret_from_fork_asm+0x1a/0x30\n[ 151.480103] \u003c/TASK\u003e",
"id": "GHSA-527m-87rr-p4rj",
"modified": "2026-06-30T03:36:50Z",
"published": "2026-05-27T15:33:15Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45898"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:27708"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:27731"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:30129"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:30848"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-45898"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2482031"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/38c5b49fffa1b760959af74f11806eeb3ef4706d"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/7874eeacfa42177565c01d5198726671acf7adf2"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/a6b9e793e74e372daa266fd0d58b751305877897"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/eb715133e0ae12514bba4d2d5ce1dee774476056"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45898.json"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-67P5-53X6-9J7Q
Vulnerability from github – Published: 2026-06-24 18:32 – Updated: 2026-06-30 03:37In the Linux kernel, the following vulnerability has been resolved:
ice: fix double-free of tx_buf skb
If ice_tso() or ice_tx_csum() fail, the error path in ice_xmit_frame_ring() frees the skb, but the 'first' tx_buf still points to it and is marked as valid (ICE_TX_BUF_SKB). 'next_to_use' remains unchanged, so the potential problem will likely fix itself when the next packet is transmitted and the tx_buf gets overwritten. But if there is no next packet and the interface is brought down instead, ice_clean_tx_ring() -> ice_unmap_and_free_tx_buf() will find the tx_buf and free the skb for the second time.
The fix is to reset the tx_buf type to ICE_TX_BUF_EMPTY in the error path, so that ice_unmap_and_free_tx_buf(). Move the initialization of 'first' up, to ensure it's already valid in case we hit the linearization error path.
The bug was spotted by AI while I had it looking for something else. It also proposed an initial version of the patch.
I reproduced the bug and tested the fix by adding code to inject failures, on a build with KASAN.
I looked for similar bugs in related Intel drivers and did not find any.
{
"affected": [],
"aliases": [
"CVE-2026-53009"
],
"database_specific": {
"cwe_ids": [
"CWE-1341",
"CWE-415",
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-24T17:17:12Z",
"severity": "HIGH"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nice: fix double-free of tx_buf skb\n\nIf ice_tso() or ice_tx_csum() fail, the error path in\nice_xmit_frame_ring() frees the skb, but the \u0027first\u0027 tx_buf still points\nto it and is marked as valid (ICE_TX_BUF_SKB).\n\u0027next_to_use\u0027 remains unchanged, so the potential problem will\nlikely fix itself when the next packet is transmitted and the tx_buf\ngets overwritten. But if there is no next packet and the interface is\nbrought down instead, ice_clean_tx_ring() -\u003e ice_unmap_and_free_tx_buf()\nwill find the tx_buf and free the skb for the second time.\n\nThe fix is to reset the tx_buf type to ICE_TX_BUF_EMPTY in the error\npath, so that ice_unmap_and_free_tx_buf().\nMove the initialization of \u0027first\u0027 up, to ensure it\u0027s already valid in\ncase we hit the linearization error path.\n\nThe bug was spotted by AI while I had it looking for something else.\nIt also proposed an initial version of the patch.\n\nI reproduced the bug and tested the fix by adding code to inject\nfailures, on a build with KASAN.\n\nI looked for similar bugs in related Intel drivers and did not find any.",
"id": "GHSA-67p5-53x6-9j7q",
"modified": "2026-06-30T03:37:13Z",
"published": "2026-06-24T18:32:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53009"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-53009"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492390"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/1a303baa715e6b78d6a406aaf335f87ff35acfcd"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/4c08fc2119ef0281cfa2cee007acf0a251be55f2"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53009.json"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-6XQC-J72Q-X4C8
Vulnerability from github – Published: 2026-05-06 12:30 – Updated: 2026-06-30 03:36In the Linux kernel, the following vulnerability has been resolved:
procfs: fix possible double mmput() in do_procmap_query()
When user provides incorrectly sized buffer for build ID for PROCMAP_QUERY we return with -ENAMETOOLONG error. After recent changes this condition happens later, after we unlocked mmap_lock/per-VMA lock and did mmput(), so original goto out is now wrong and will double-mmput() mm_struct. Fix by jumping further to clean up only vm_file and name_buf.
{
"affected": [],
"aliases": [
"CVE-2026-43178"
],
"database_specific": {
"cwe_ids": [
"CWE-1341",
"CWE-415"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-06T12:16:36Z",
"severity": "HIGH"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nprocfs: fix possible double mmput() in do_procmap_query()\n\nWhen user provides incorrectly sized buffer for build ID for PROCMAP_QUERY\nwe return with -ENAMETOOLONG error. After recent changes this condition\nhappens later, after we unlocked mmap_lock/per-VMA lock and did mmput(),\nso original goto out is now wrong and will double-mmput() mm_struct. Fix\nby jumping further to clean up only vm_file and name_buf.",
"id": "GHSA-6xqc-j72q-x4c8",
"modified": "2026-06-30T03:36:32Z",
"published": "2026-05-06T12:30:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43178"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-43178"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467227"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/61dc9f776705d6db6847c101b98fa4f0e9eb6fa3"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/8adaff87db143583e08eec4f4e7788f1ef8af94d"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/90f5e87c9b75833b9ef3a4415b92c0247f28ab2f"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/f9fe092084cd04deea18747f58a2304026e76aaa"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43178.json"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-82G8-464F-2MV7
Vulnerability from github – Published: 2026-02-27 21:36 – Updated: 2026-03-12 17:30Summary
applySkillConfigEnvOverrides previously copied skills.entries.*.env values into the host process.env without applying the host env safety policy.
Impact
In affected versions, dangerous process-level variables such as NODE_OPTIONS could be injected when unset, which can influence runtime/child-process behavior.
Required attacker capability
An attacker must be able to modify OpenClaw local state/config (for example ~/.openclaw/openclaw.json) to set skills.entries.<skill>.env or related skill config values.
Remediation
Fixed in 2026.2.21 by sanitizing skill env overrides and blocking dangerous host env keys (including NODE_OPTIONS) before applying overrides, with regression tests covering blocked dangerous keys.
Fix Commit(s)
8c9f35cdb51692b650ddf05b259ccdd75cc9a83c
Found using MCPwner
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "openclaw"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2026.2.21"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-4039"
],
"database_specific": {
"cwe_ids": [
"CWE-1341",
"CWE-15",
"CWE-94"
],
"github_reviewed": true,
"github_reviewed_at": "2026-02-27T21:36:17Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "### Summary\n`applySkillConfigEnvOverrides` previously copied `skills.entries.*.env` values into the host `process.env` without applying the host env safety policy.\n\n### Impact\nIn affected versions, dangerous process-level variables such as `NODE_OPTIONS` could be injected when unset, which can influence runtime/child-process behavior.\n\n### Required attacker capability\nAn attacker must be able to modify OpenClaw local state/config (for example `~/.openclaw/openclaw.json`) to set `skills.entries.\u003cskill\u003e.env` or related skill config values.\n\n### Remediation\nFixed in `2026.2.21` by sanitizing skill env overrides and blocking dangerous host env keys (including `NODE_OPTIONS`) before applying overrides, with regression tests covering blocked dangerous keys.\n\n## Fix Commit(s)\n- `8c9f35cdb51692b650ddf05b259ccdd75cc9a83c`\n\nFound using [MCPwner](https://github.com/Pigyon/MCPwner)",
"id": "GHSA-82g8-464f-2mv7",
"modified": "2026-03-12T17:30:21Z",
"published": "2026-02-27T21:36:17Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-82g8-464f-2mv7"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4039"
},
{
"type": "WEB",
"url": "https://github.com/openclaw/openclaw/commit/8c9f35cdb51692b650ddf05b259ccdd75cc9a83c"
},
{
"type": "PACKAGE",
"url": "https://github.com/openclaw/openclaw"
},
{
"type": "WEB",
"url": "https://github.com/openclaw/openclaw/releases/tag/v2026.2.21"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "OpenClaw: Skill env override host env injection via applySkillConfigEnvOverrides (defense-in-depth)"
}
GHSA-CC57-HGV8-P56R
Vulnerability from github – Published: 2025-02-05 12:33 – Updated: 2025-03-07 03:31libcurl would wrongly close the same eventfd file descriptor twice when taking down a connection channel after having completed a threaded name resolve.
{
"affected": [],
"aliases": [
"CVE-2025-0665"
],
"database_specific": {
"cwe_ids": [
"CWE-1341"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-05T10:15:22Z",
"severity": "CRITICAL"
},
"details": "libcurl would wrongly close the same eventfd file descriptor twice when taking\ndown a connection channel after having completed a threaded name resolve.",
"id": "GHSA-cc57-hgv8-p56r",
"modified": "2025-03-07T03:31:32Z",
"published": "2025-02-05T12:33:07Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0665"
},
{
"type": "WEB",
"url": "https://hackerone.com/reports/2954286"
},
{
"type": "WEB",
"url": "https://curl.se/docs/CVE-2025-0665.html"
},
{
"type": "WEB",
"url": "https://curl.se/docs/CVE-2025-0665.json"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20250306-0007"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2025/02/05/2"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2025/02/05/5"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-J5VG-4JFW-25G2
Vulnerability from github – Published: 2026-06-24 18:32 – Updated: 2026-06-30 03:37In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: avoid double drm_exec_fini() in userq validate
When new_addition is true, amdgpu_userq_vm_validate() calls drm_exec_fini(&exec) before iterating over the collected HMM ranges and calling amdgpu_ttm_tt_get_user_pages().
If amdgpu_ttm_tt_get_user_pages() fails in that path, the code jumps to unlock_all and calls drm_exec_fini(&exec) a second time on the same exec object. drm_exec_fini() is not idempotent: it frees exec->objects and may also drop exec->contended and finalize the ww acquire context.
Route that error path directly to the range cleanup once exec has already been finalized.
Issue found using a prototype static analysis tool and confirmed by code review.
(cherry picked from commit 2802952e4a07306da6ebe813ff1acacc5691851a)
{
"affected": [],
"aliases": [
"CVE-2026-52987"
],
"database_specific": {
"cwe_ids": [
"CWE-1341"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-24T17:17:09Z",
"severity": "HIGH"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: avoid double drm_exec_fini() in userq validate\n\nWhen new_addition is true, amdgpu_userq_vm_validate() calls\ndrm_exec_fini(\u0026exec) before iterating over the collected HMM ranges and\ncalling amdgpu_ttm_tt_get_user_pages().\n\nIf amdgpu_ttm_tt_get_user_pages() fails in that path, the code jumps to\nunlock_all and calls drm_exec_fini(\u0026exec) a second time on the same\nexec object. drm_exec_fini() is not idempotent: it frees exec-\u003eobjects\nand may also drop exec-\u003econtended and finalize the ww acquire context.\n\nRoute that error path directly to the range cleanup once exec has\nalready been finalized.\n\nIssue found using a prototype static analysis tool\nand confirmed by code review.\n\n(cherry picked from commit 2802952e4a07306da6ebe813ff1acacc5691851a)",
"id": "GHSA-j5vg-4jfw-25g2",
"modified": "2026-06-30T03:37:12Z",
"published": "2026-06-24T18:32:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-52987"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-52987"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492365"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/508babf310365f1107a2e8831c267c292a286818"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/c7c3ae7c01e5a0742b93cb9b40800bdd7f811e38"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-52987.json"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-M5W6-2MRP-4227
Vulnerability from github – Published: 2026-05-21 12:31 – Updated: 2026-06-30 03:36In the Linux kernel, the following vulnerability has been resolved:
net/rds: reset op_nents when zerocopy page pin fails
When iov_iter_get_pages2() fails in rds_message_zcopy_from_user(), the pinned pages are released with put_page(), and rm->data.op_mmp_znotifier is cleared. But we fail to properly clear rm->data.op_nents.
Later when rds_message_purge() is called from rds_sendmsg() the cleanup loop iterates over the incorrectly non zero number of op_nents and frees them again.
Fix this by properly resetting op_nents when it should be in rds_message_zcopy_from_user().
{
"affected": [],
"aliases": [
"CVE-2026-43494"
],
"database_specific": {
"cwe_ids": [
"CWE-1341"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-21T12:16:19Z",
"severity": "HIGH"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/rds: reset op_nents when zerocopy page pin fails\n\nWhen iov_iter_get_pages2() fails in rds_message_zcopy_from_user(),\nthe pinned pages are released with put_page(), and\nrm-\u003edata.op_mmp_znotifier is cleared. But we fail to properly\nclear rm-\u003edata.op_nents.\n\nLater when rds_message_purge() is called from rds_sendmsg() the\ncleanup loop iterates over the incorrectly non zero number of\nop_nents and frees them again.\n\nFix this by properly resetting op_nents when it should be in\nrds_message_zcopy_from_user().",
"id": "GHSA-m5w6-2mrp-4227",
"modified": "2026-06-30T03:36:46Z",
"published": "2026-05-21T12:31:45Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43494"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-43494"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480434"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/03014551938a0887fa55f18ce49b70158a9c0113"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/0bbbff00a15b1df2cac9014d6cf4b6890f473353"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/290e833d1acb1093bc121fcdc97f5e6161157479"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/640e37f58f991546a87540d067279c2c1fa9fe51"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/9115669faedccdda100428e2d26fd0aac8c50799"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/c6e51512a784c4a7b86e1a044988696e3b3721fa"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/d84ce1786ce40fdd3dd98db47aec5527817e1ef6"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/e174929793195e0cd6a4adb0cad731b39f9019b4"
},
{
"type": "WEB",
"url": "https://github.com/v12-security/pocs/tree/main/pintheft"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43494.json"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2026/05/21/2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-P8FM-9C82-PW4G
Vulnerability from github – Published: 2026-05-04 15:31 – Updated: 2026-06-30 03:36Double Free and possible RCE vulnerability in Apache HTTP Server with the HTTP/2 protocol.
This issue affects Apache HTTP Server: 2.4.66.
Users are recommended to upgrade to version 2.4.67, which fixes the issue.
{
"affected": [],
"aliases": [
"CVE-2026-23918"
],
"database_specific": {
"cwe_ids": [
"CWE-1341",
"CWE-415"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-04T15:16:03Z",
"severity": "HIGH"
},
"details": "Double Free and possible RCE vulnerability in Apache HTTP Server with the HTTP/2 protocol.\n\nThis issue affects Apache HTTP Server: 2.4.66.\n\nUsers are recommended to upgrade to version 2.4.67, which fixes the issue.",
"id": "GHSA-p8fm-9c82-pw4g",
"modified": "2026-06-30T03:36:29Z",
"published": "2026-05-04T15:31:15Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-23918"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:13938"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-23918"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2465304"
},
{
"type": "WEB",
"url": "https://httpd.apache.org/security/vulnerabilities_24.html"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23918.json"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2026/05/04/19"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-XR9J-C7V6-7542
Vulnerability from github – Published: 2023-11-01 18:30 – Updated: 2024-03-12 21:30A use-after-free vulnerability was found in drivers/nvme/target/tcp.cinnvmet_tcp_free_crypto` due to a logical bug in the NVMe-oF/TCP subsystem in the Linux kernel. This issue may allow a malicious user to cause a use-after-free and double-free problem, which may permit remote code execution or lead to local privilege escalation in case that the attacker already has local privileges.
{
"affected": [],
"aliases": [
"CVE-2023-5178"
],
"database_specific": {
"cwe_ids": [
"CWE-1341",
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-11-01T17:15:11Z",
"severity": "HIGH"
},
"details": "A use-after-free vulnerability was found in drivers/nvme/target/tcp.c` in `nvmet_tcp_free_crypto` due to a logical bug in the NVMe-oF/TCP subsystem in the Linux kernel. This issue may allow a malicious user to cause a use-after-free and double-free problem, which may permit remote code execution or lead to local privilege escalation in case that the attacker already has local privileges.",
"id": "GHSA-xr9j-c7v6-7542",
"modified": "2024-03-12T21:30:58Z",
"published": "2023-11-01T18:30:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-5178"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20231208-0004"
},
{
"type": "WEB",
"url": "https://lore.kernel.org/linux-nvme/20231002105428.226515-1-sagi@grimberg.me"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2024/01/msg00005.html"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2241924"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2023-5178"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:1278"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:1269"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:1268"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:0575"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:0554"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:0461"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:0432"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:0431"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:0412"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:0386"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:0378"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:0340"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2023:7559"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2023:7557"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2023:7554"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2023:7551"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2023:7549"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2023:7548"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2023:7418"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2023:7379"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2023:7370"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
Change the code's logic so that the resource is only closed once. This might require simplifying or refactoring. This fix can be simple to do in small code blocks, but more difficult when multiple closes are buried within complex conditionals.
Mitigation
Strategy: Refactoring
It can be effective to implement a flag that is (1) set when the resource is opened, (2) cleared when it is closed, and (3) checked before closing. This approach can be useful when there are disparate cases in which closes must be performed. However, flag-tracking can increase code complexity and requires diligent compliance by the programmer.
Mitigation
Strategy: Refactoring
When closing a resource, set the resource's associated variable to NULL or equivalent value for the given language. Some APIs will ignore this null value without causing errors. For other APIs, this can lead to application crashes or exceptions, which may still be preferable to corrupting an unintended resource such as memory or data.
No CAPEC attack patterns related to this CWE.