The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
7,478 vulnerabilities with CWE-416
CVE-2026-31566
HIGH
drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib
CVSS 7.8
CVE-2026-31554
HIGH
futex: Require sys_futex_requeue() to have identical flags
CVSS 7.8
CVE-2026-31541
HIGH
tracing: Fix trace_marker copy link list updates
CVSS 7.8
CVE-2026-6919
CRITICAL
Google Chrome < 147.0.7727.117 - Use-After-Free in DevTools
CVSS 9.6
CVE-2026-31533
CRITICAL
Linux - Use-After-Free in TLS Encryption Error Path
CVSS 9.8
CVE-2026-31532
HIGH
Linux - Use-After-Free in raw_rcv() via ro->uniq
CVSS 7.8
CVE-2026-31530
HIGH
cxl/port: Fix use after free of parent_port in cxl_detach_ep()
CVSS 7.8
CVE-2026-31527
HIGH
driver core: platform: use generic driver_override infrastructure
CVSS 7.8
CVE-2026-31511
HIGH
Bluetooth: MGMT: Fix dangling pointer on mgmt_add_adv_patterns_monitor_complete
CVSS 7.8
CVE-2026-31504
HIGH
net: fix fanout UAF in packet_release() via NETDEV_UP race
CVSS 7.8
CVE-2026-31501
CRITICAL
net: ti: icssg-prueth: fix use-after-free of CPPI descriptor in RX path
CVSS 9.8
CVE-2026-31500
HIGH
Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock
CVSS 7.8
CVE-2026-31493
HIGH
Linux Kernel EFA RDMA - Completion Context Use-After-Free
CVSS 7.8
CVE-2026-31490
HIGH
Linux Kernel - Use-After-Free in Xe SR-IOV PF Migration Restore
CVSS 7.8
CVE-2026-31488
HIGH
drm/amd/display: Do not skip unrelated mode changes in DSC validation
CVSS 7.8
CVE-2026-31485
HIGH
Linux Kernel spi-fsl-lpspi - Teardown Use-After-Free
CVSS 7.8
CVE-2026-31474
HIGH
can: isotp: fix tx.buf use-after-free in isotp_sendmsg()
CVSS 7.8
CVE-2026-31473
HIGH
media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex
CVSS 7.8
CVE-2026-31469
HIGH
virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false
CVSS 7.8
CVE-2026-31455
HIGH
xfs: stop reclaim before pushing AIL during unmount
CVSS 7.8
CVE-2026-31454
HIGH
xfs: save ailp before dropping the AIL lock in push callbacks
CVSS 7.8
CVE-2026-31446
HIGH
ext4: fix use-after-free in update_super_work when racing with umount
CVSS 7.8
CVE-2026-31444
CRITICAL
ksmbd: fix use-after-free and NULL deref in smb_grant_oplock()
CVSS 9.8
CVE-2026-33259
MEDIUM
Concurrent modification of RPZ data can lead to denial of servce
CVSS 5.0
CVE-2026-5398
HIGH
Kernel use-after-free bug in the TIOCNOTTY handler
CVSS 8.4
Details
Vulnerabilities
7,478
Exploit Likelihood
High