CWE-416
AllowedUse After Free
Abstraction: Variant · Status: Stable
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
11162 vulnerabilities reference this CWE, most recent first.
GHSA-4932-9H4W-23JV
Vulnerability from github – Published: 2022-05-24 17:32 – Updated: 2022-05-24 17:32Use after free in WebRTC in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
{
"affected": [],
"aliases": [
"CVE-2020-15969"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-11-03T03:15:00Z",
"severity": "HIGH"
},
"details": "Use after free in WebRTC in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.",
"id": "GHSA-4932-9h4w-23jv",
"modified": "2022-05-24T17:32:51Z",
"published": "2022-05-24T17:32:51Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15969"
},
{
"type": "WEB",
"url": "https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html"
},
{
"type": "WEB",
"url": "https://crbug.com/1124659"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/24QFL4C3AZKMFVL7LVSYMU2DNE5VVUGS"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4GWCWNHTTYOH6HSFUXPGPBB6J6JYZHZE"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SC3U3H6AISVZB5PLZLLNF4HMQ4UFFL7M"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/202101-30"
},
{
"type": "WEB",
"url": "https://support.apple.com/kb/HT212003"
},
{
"type": "WEB",
"url": "https://support.apple.com/kb/HT212005"
},
{
"type": "WEB",
"url": "https://support.apple.com/kb/HT212007"
},
{
"type": "WEB",
"url": "https://support.apple.com/kb/HT212009"
},
{
"type": "WEB",
"url": "https://support.apple.com/kb/HT212011"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2021/dsa-4824"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00016.html"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2020/Dec/24"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2020/Dec/26"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2020/Dec/27"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2020/Dec/29"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2020/Dec/30"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-496C-FQ9M-2RHQ
Vulnerability from github – Published: 2026-05-28 12:30 – Updated: 2026-06-24 18:32In the Linux kernel, the following vulnerability has been resolved:
mm/damon/sysfs-schemes: protect memcg_path kfree() with damon_sysfs_lock
Patch series "mm/damon/sysfs-schemes: fix use-after-free for [memcg_]path".
Reads of 'memcg_path' and 'path' files in DAMON sysfs interface could race with their writes, results in use-after-free. Fix those.
This patch (of 2):
damon_sysfs_scheme_filter->mmecg_path can be read and written by users, via DAMON sysfs memcg_path file. It can also be indirectly read, for the parameters {on,off}line committing to DAMON. The reads for parameters committing are protected by damon_sysfs_lock to avoid the sysfs files being destroyed while any of the parameters are being read. But the user-driven direct reads and writes are not protected by any lock, while the write is deallocating the memcg_path-pointing buffer. As a result, the readers could read the already freed buffer (user-after-free). Note that the user-reads don't race when the same open file is used by the writer, due to kernfs's open file locking. Nonetheless, doing the reads and writes with separate open files would be common. Fix it by protecting both the user-direct reads and writes with damon_sysfs_lock.
{
"affected": [],
"aliases": [
"CVE-2026-46121"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-28T10:16:27Z",
"severity": "HIGH"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/damon/sysfs-schemes: protect memcg_path kfree() with damon_sysfs_lock\n\nPatch series \"mm/damon/sysfs-schemes: fix use-after-free for [memcg_]path\".\n\nReads of \u0027memcg_path\u0027 and \u0027path\u0027 files in DAMON sysfs interface could race\nwith their writes, results in use-after-free. Fix those.\n\n\nThis patch (of 2):\n\ndamon_sysfs_scheme_filter-\u003emmecg_path can be read and written by users,\nvia DAMON sysfs memcg_path file. It can also be indirectly read, for the\nparameters {on,off}line committing to DAMON. The reads for parameters\ncommitting are protected by damon_sysfs_lock to avoid the sysfs files\nbeing destroyed while any of the parameters are being read. But the\nuser-driven direct reads and writes are not protected by any lock, while\nthe write is deallocating the memcg_path-pointing buffer. As a result,\nthe readers could read the already freed buffer (user-after-free). Note\nthat the user-reads don\u0027t race when the same open file is used by the\nwriter, due to kernfs\u0027s open file locking. Nonetheless, doing the reads\nand writes with separate open files would be common. Fix it by protecting\nboth the user-direct reads and writes with damon_sysfs_lock.",
"id": "GHSA-496c-fq9m-2rhq",
"modified": "2026-06-24T18:32:32Z",
"published": "2026-05-28T12:30:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46121"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/1e68eb96e8beb1abefd12dd22c5637795d8a877e"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/b1e9f2d5870776347edef927f9bb3ea19b8e3abb"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/baecc45ad60e621ef14d6c1e7f41ef36bbfdf910"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/c88802d0e8edd14b6cd2daf3000f99adbc4c85c5"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/eafd6f5372d29b0dd213799b92c2c9c7ad31d7da"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-496W-F8VC-3275
Vulnerability from github – Published: 2022-05-13 01:25 – Updated: 2022-05-13 01:25The do_get_mempolicy function in mm/mempolicy.c in the Linux kernel before 4.12.9 allows local users to cause a denial of service (use-after-free) or possibly have unspecified other impact via crafted system calls.
{
"affected": [],
"aliases": [
"CVE-2018-10675"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-05-02T18:29:00Z",
"severity": "HIGH"
},
"details": "The do_get_mempolicy function in mm/mempolicy.c in the Linux kernel before 4.12.9 allows local users to cause a denial of service (use-after-free) or possibly have unspecified other impact via crafted system calls.",
"id": "GHSA-496w-f8vc-3275",
"modified": "2022-05-13T01:25:18Z",
"published": "2022-05-13T01:25:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-10675"
},
{
"type": "WEB",
"url": "https://github.com/torvalds/linux/commit/73223e4e2e3867ebf033a5a8eb2e5df0158ccc99"
},
{
"type": "WEB",
"url": "https://www.oracle.com/security-alerts/cpujul2020.html"
},
{
"type": "WEB",
"url": "https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.12.9"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/3754-1"
},
{
"type": "WEB",
"url": "https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2018:3590"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2018:3586"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2018:3540"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2018:2933"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2018:2925"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2018:2924"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2018:2791"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2018:2785"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2018:2395"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2018:2384"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2018:2164"
},
{
"type": "WEB",
"url": "http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=73223e4e2e3867ebf033a5a8eb2e5df0158ccc99"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/104093"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-4993-3WVP-RC4M
Vulnerability from github – Published: 2022-05-24 17:32 – Updated: 2022-05-24 17:32Use after free in autofill in Google Chrome prior to 86.0.4240.75 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
{
"affected": [],
"aliases": [
"CVE-2020-15990"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-11-03T03:15:00Z",
"severity": "HIGH"
},
"details": "Use after free in autofill in Google Chrome prior to 86.0.4240.75 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.",
"id": "GHSA-4993-3wvp-rc4m",
"modified": "2022-05-24T17:32:54Z",
"published": "2022-05-24T17:32:54Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15990"
},
{
"type": "WEB",
"url": "https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html"
},
{
"type": "WEB",
"url": "https://crbug.com/1133671"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/24QFL4C3AZKMFVL7LVSYMU2DNE5VVUGS"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4GWCWNHTTYOH6HSFUXPGPBB6J6JYZHZE"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SC3U3H6AISVZB5PLZLLNF4HMQ4UFFL7M"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2021/dsa-4824"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00016.html"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-49C5-693H-32P7
Vulnerability from github – Published: 2026-09-03 21:31 – Updated: 2026-09-03 21:31Use after free in Skia in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
{
"affected": [],
"aliases": [
"CVE-2026-85049"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-03T20:17:25Z",
"severity": "HIGH"
},
"details": "Use after free in Skia in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)",
"id": "GHSA-49c5-693h-32p7",
"modified": "2026-09-03T21:31:16Z",
"published": "2026-09-03T21:31:16Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85049"
},
{
"type": "WEB",
"url": "https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_01882797386.html"
},
{
"type": "WEB",
"url": "https://issues.chromium.org/issues/553345874"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-49C8-7MPF-M266
Vulnerability from github – Published: 2026-06-24 18:32 – Updated: 2026-06-28 09:31In the Linux kernel, the following vulnerability has been resolved:
net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove
In qrtr_port_remove(), the socket reference count is decremented via __sock_put() before the port is removed from the qrtr_ports XArray and before the RCU grace period elapses.
This breaks the fundamental RCU update paradigm. It exposes a race window where a concurrent RCU reader (such as qrtr_reset_ports() or qrtr_port_lookup()) can obtain a pointer to the socket from the XArray, and attempt to call sock_hold() on a socket whose reference count has already dropped to zero.
This exact race condition was hit during syzkaller fuzzing, leading to the following refcount saturation warning and a potential Use-After-Free:
refcount_t: saturated; leaking memory. WARNING: CPU: 3 PID: 1273 at lib/refcount.c:22 refcount_warn_saturate+0xae/0x1d0 Modules linked in: qrtr(+) bochs drm_shmem_helper ... Call Trace: qrtr_reset_ports net/qrtr/af_qrtr.c:768 [inline] [qrtr] __qrtr_bind.isra.0+0x48b/0x570 net/qrtr/af_qrtr.c:805 [qrtr] qrtr_bind+0x17d/0x210 net/qrtr/af_qrtr.c:901 [qrtr] kernel_bind+0xe4/0x120 net/socket.c:3592 qrtr_ns_init+0x1a6/0x380 net/qrtr/ns.c:715 [qrtr] qrtr_proto_init+0x3b/0xff0 net/qrtr/af_qrtr.c:169 [qrtr] do_one_initcall+0xf5/0x5e0 init/main.c:1283 ...
Fix this by deferring the reference count decrement until after the xa_erase() and the synchronize_rcu() complete.
(Note: The v1 of this patch incorrectly replaced __sock_put() with sock_put(). As Simon Horman pointed out, the callers of qrtr_port_remove() still hold a reference to the socket, so freeing the socket memory here would lead to a subsequent UAF in the caller. Thus, the __sock_put() is kept, but only repositioned to close the RCU race.)
{
"affected": [],
"aliases": [
"CVE-2026-52947"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-24T17:17:04Z",
"severity": "HIGH"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove\n\nIn qrtr_port_remove(), the socket reference count is decremented via\n__sock_put() before the port is removed from the qrtr_ports XArray and\nbefore the RCU grace period elapses.\n\nThis breaks the fundamental RCU update paradigm. It exposes a race\nwindow where a concurrent RCU reader (such as qrtr_reset_ports() or\nqrtr_port_lookup()) can obtain a pointer to the socket from the XArray,\nand attempt to call sock_hold() on a socket whose reference count has\nalready dropped to zero.\n\nThis exact race condition was hit during syzkaller fuzzing, leading to\nthe following refcount saturation warning and a potential Use-After-Free:\n\n refcount_t: saturated; leaking memory.\n WARNING: CPU: 3 PID: 1273 at lib/refcount.c:22 refcount_warn_saturate+0xae/0x1d0\n Modules linked in: qrtr(+) bochs drm_shmem_helper ...\n Call Trace:\n \u003cTASK\u003e\n qrtr_reset_ports net/qrtr/af_qrtr.c:768 [inline] [qrtr]\n __qrtr_bind.isra.0+0x48b/0x570 net/qrtr/af_qrtr.c:805 [qrtr]\n qrtr_bind+0x17d/0x210 net/qrtr/af_qrtr.c:901 [qrtr]\n kernel_bind+0xe4/0x120 net/socket.c:3592\n qrtr_ns_init+0x1a6/0x380 net/qrtr/ns.c:715 [qrtr]\n qrtr_proto_init+0x3b/0xff0 net/qrtr/af_qrtr.c:169 [qrtr]\n do_one_initcall+0xf5/0x5e0 init/main.c:1283\n ...\n \u003c/TASK\u003e\n\nFix this by deferring the reference count decrement until after the\nxa_erase() and the synchronize_rcu() complete.\n\n(Note: The v1 of this patch incorrectly replaced __sock_put() with\nsock_put(). As Simon Horman pointed out, the callers of qrtr_port_remove()\nstill hold a reference to the socket, so freeing the socket memory here\nwould lead to a subsequent UAF in the caller. Thus, the __sock_put() is\nkept, but only repositioned to close the RCU race.)",
"id": "GHSA-49c8-7mpf-m266",
"modified": "2026-06-28T09:31:37Z",
"published": "2026-06-24T18:32:41Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-52947"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/03bfa95e452e2b6ccd76a332060ae4feaf5ad84d"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/2047c2aa0963bb2872fd722300a15bcb441a4c00"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/2aa4c12723fe432e623462a3be42a197a128722b"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/3b20ec8f31e8a6a6782243f473b0abd3463621df"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/474293d90880622fde9d2430fb0165767090f7b3"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/7de2d447072be3b1a76793f034432338fc9c494b"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/a2171131ecda1ed61a594a1eb715e75fdad0fef5"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/ab269990ed58143a92a263be1bee626d82ac03da"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-49FF-8X5V-9F8C
Vulnerability from github – Published: 2026-08-07 00:31 – Updated: 2026-08-07 15:33Use after free in Views in Google Chrome on Windows prior to 151.0.7922.109 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
{
"affected": [],
"aliases": [
"CVE-2026-19158"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-06T22:16:58Z",
"severity": "HIGH"
},
"details": "Use after free in Views in Google Chrome on Windows prior to 151.0.7922.109 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)",
"id": "GHSA-49ff-8x5v-9f8c",
"modified": "2026-08-07T15:33:11Z",
"published": "2026-08-07T00:31:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-19158"
},
{
"type": "WEB",
"url": "https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_01193673229.html"
},
{
"type": "WEB",
"url": "https://issues.chromium.org/issues/535749174"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-49FQ-PW77-6QXJ
Vulnerability from github – Published: 2021-08-25 20:44 – Updated: 2023-06-13 21:55Affected versions of this crate did not clone contained strings when an interner is cloned. Interners have raw pointers to the contained strings, and they keep pointing the strings which the old interner owns, after the interner is cloned. If a new cloned interner is alive and the old original interner is dead, the new interner has dangling pointers to the old interner's storage, which is already dropped.
This allows an attacker to read the already freed memory. The dangling pointers are used by the interners to check a string is already interned. An attacker can do brute force attack to get the data pointed by the dangling pointer.
{
"affected": [
{
"package": {
"ecosystem": "crates.io",
"name": "string-interner"
},
"ranges": [
{
"events": [
{
"introduced": "0.7.0"
},
{
"fixed": "0.7.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "crates.io",
"name": "string-interner"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.6.4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2019-16882"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": true,
"github_reviewed_at": "2021-08-19T21:23:01Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "Affected versions of this crate did not clone contained strings when an interner is cloned. Interners have raw pointers to the contained strings, and they keep pointing the strings which the old interner owns, after the interner is cloned. If a new cloned interner is alive and the old original interner is dead, the new interner has dangling pointers to the old interner\u0027s storage, which is already dropped.\n\nThis allows an attacker to read the already freed memory. The dangling pointers are used by the interners to check a string is already interned. An attacker can do brute force attack to get the data pointed by the dangling pointer.",
"id": "GHSA-49fq-pw77-6qxj",
"modified": "2023-06-13T21:55:41Z",
"published": "2021-08-25T20:44:15Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-16882"
},
{
"type": "WEB",
"url": "https://github.com/Robbepop/string-interner/issues/9"
},
{
"type": "WEB",
"url": "https://github.com/Robbepop/string-interner/pull/10"
},
{
"type": "WEB",
"url": "https://github.com/Robbepop/string-interner/commit/d91dac0cfe42512526879cdfaac0b81beff54089"
},
{
"type": "PACKAGE",
"url": "https://github.com/Robbepop/string-interner"
},
{
"type": "WEB",
"url": "https://rustsec.org/advisories/RUSTSEC-2019-0023.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Use after free in string-interner"
}
GHSA-49P8-H7PF-GRWP
Vulnerability from github – Published: 2026-07-25 12:31 – Updated: 2026-07-27 06:30In the Linux kernel, the following vulnerability has been resolved:
fuse-uring: Avoid use-after-free in fuse_uring_async_stop_queues
fuse_uring_async_stop_queues() might run when the last reference on ring->queue_refs was already dropped.
In order to avoid an early destruction a reference on struct fuse_conn is now taken before starting fuse_uring_async_stop_queues() and that reference is only released when that delayed work queue terminates.
{
"affected": [],
"aliases": [
"CVE-2026-64261"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-25T10:17:06Z",
"severity": "HIGH"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nfuse-uring: Avoid use-after-free in fuse_uring_async_stop_queues\n\nfuse_uring_async_stop_queues() might run when the last reference\non ring-\u003equeue_refs was already dropped.\n\nIn order to avoid an early destruction a reference on struct fuse_conn\nis now taken before starting fuse_uring_async_stop_queues() and that\nreference is only released when that delayed work queue terminates.",
"id": "GHSA-49p8-h7pf-grwp",
"modified": "2026-07-27T06:30:31Z",
"published": "2026-07-25T12:31:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64261"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/23a356e0bd96c8d5fb3ddff069f692bf10cab5c1"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/95d7f50aff2a5f71557263ff25b97b2951f32bf8"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/d351da75066955144515cb2f9aa959f24a04287a"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-49PM-CGMH-HW25
Vulnerability from github – Published: 2025-10-30 06:30 – Updated: 2026-04-20 15:31A flaw was found in the X.Org X server and Xwayland when processing X11 Present extension notifications. Improper error handling during notification creation can leave dangling pointers that lead to a use-after-free condition. This can cause memory corruption or a crash, potentially allowing an attacker to execute arbitrary code or cause a denial of service.
{
"affected": [],
"aliases": [
"CVE-2025-62229"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-10-30T06:15:45Z",
"severity": "HIGH"
},
"details": "A flaw was found in the X.Org X server and Xwayland when processing X11 Present extension notifications. Improper error handling during notification creation can leave dangling pointers that lead to a use-after-free condition. This can cause memory corruption or a crash, potentially allowing an attacker to execute arbitrary code or cause a denial of service.",
"id": "GHSA-49pm-cgmh-hw25",
"modified": "2026-04-20T15:31:49Z",
"published": "2025-10-30T06:30:53Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62229"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:22167"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:22364"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:22365"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:22426"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:22427"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:22667"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:22729"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:22742"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:22753"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:0031"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:0033"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:0034"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:0035"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:0036"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2025-62229"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2402649"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00033.html"
},
{
"type": "WEB",
"url": "https://lists.x.org/archives/xorg-announce/2025-October/003635.html"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:19432"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:19433"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:19434"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:19435"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:19489"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:19623"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:19909"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:20958"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:20960"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:20961"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:21035"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:22040"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:22041"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:22051"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:22055"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:22056"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:22077"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:22096"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:22164"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2025/10/28/7"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
Strategy: Language Selection
Choose a language that provides automatic memory management.
Mitigation
Strategy: Attack Surface Reduction
When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.
No CAPEC attack patterns related to this CWE.