The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
8,043 vulnerabilities with CWE-416
CVE-2026-53296
HIGH
mailbox: mailbox-test: free channels on probe error
CVSS 7.8
CVE-2026-53290
HIGH
drm/xe/eustall: Fix drm_dev_put called before stream disable in close
CVSS 7.8
CVE-2026-48090
MEDIUM
Envoy HTTP: OAuth2 filter late async token completion after stream teardown (UAF / crash risk)
CVSS 5.9
CVE-2026-47205
MEDIUM
Envoy: ext_authz Use-After-Free during Stream Teardown with Per-Route Overrides
CVSS 5.9
CVE-2026-47207
MEDIUM
Envoy crashes if multiple unexpected ext_proc responses are packed into one gRPC message
CVSS 6.5
CVE-2026-13283
HIGH
Google Chrome - Use After Free
CVSS 7.5
CVE-2026-13282
MEDIUM
Google Chrome - Use After Free
CVSS 6.8
CVE-2026-7531
CRITICAL
Use-after-free in PQC hybrid key-share handling
CVSS 9.8
CVE-2026-12921
HIGH
Use after free in AzeoTech DAQFactory
CVSS 7.8
CVE-2026-57438
MEDIUM
Nokogiri: Possible Use-After-Free in XInclude Processing
CVSS 6.6
CVE-2026-57437
MEDIUM
Nokogiri: Possible Use-After-Free when directly using `NokogirI::XML::XPathContext` beyond document lifetime
CVSS 5.3
CVE-2026-57436
MEDIUM
Nokogiri: Possible Use-After-Free when setting `Document#root=` to an invalid node type
CVSS 5.3
CVE-2026-57435
HIGH
Nokogiri: Possible Use-After-Free when setting an attribute value via `Nokogiri::XML::Attr#value=` or `#content=`
CVSS 7.5
CVE-2026-57236
HIGH
Nokogiri: Possible Use-After-Free when `Nokogiri::XML::Document#encoding=` raises an exception
CVSS 8.2
CVE-2026-53276
HIGH
Linux - Use After Free
CVSS 7.8
CVE-2026-53275
HIGH
ipv6: mcast: Fix use-after-free when processing MLD queries
CVSS 8.8
CVE-2026-53273
HIGH
tee: optee: prevent use-after-free when the client exits before the supplicant
CVSS 7.8
CVE-2026-53272
HIGH
erofs: fix use-after-free on sbi->sync_decompress
CVSS 7.8
CVE-2026-53264
HIGH
net/sched: act_api: use RCU with deferred freeing for action lifecycle
CVSS 7.8
CVE-2026-53260
CRITICAL
tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req().
CVSS 9.8
CVE-2026-53259
HIGH
ipv6: anycast: insert aca into global hash under idev->lock
CVSS 7.8
CVE-2026-53256
HIGH
Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind()
CVSS 8.0
CVE-2026-53248
HIGH
net: airoha: Fix use-after-free in metadata dst teardown
CVSS 8.8
CVE-2026-53247
CRITICAL
Linux - Use After Free
CVSS 9.8
CVE-2026-53240
HIGH
xfrm: iptfs: fix use-after-free on first_skb in __input_process_payload
CVSS 8.8
Details
Vulnerabilities
8,043
Exploit Likelihood
High