CWE-416

High likelihood

Use After Free

Parent: CWE-825 - Expired Pointer Dereference

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

7,478 vulnerabilities with CWE-416
CVE-2026-31566 HIGH
drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib
CVSS 7.8
CVE-2026-31554 HIGH
futex: Require sys_futex_requeue() to have identical flags
CVSS 7.8
CVE-2026-31541 HIGH
tracing: Fix trace_marker copy link list updates
CVSS 7.8
CVE-2026-6919 CRITICAL
Google Chrome < 147.0.7727.117 - Use-After-Free in DevTools
CVSS 9.6
CVE-2026-31533 CRITICAL
Linux - Use-After-Free in TLS Encryption Error Path
CVSS 9.8
CVE-2026-31532 HIGH
Linux - Use-After-Free in raw_rcv() via ro->uniq
CVSS 7.8
CVE-2026-31530 HIGH
cxl/port: Fix use after free of parent_port in cxl_detach_ep()
CVSS 7.8
CVE-2026-31527 HIGH
driver core: platform: use generic driver_override infrastructure
CVSS 7.8
CVE-2026-31511 HIGH
Bluetooth: MGMT: Fix dangling pointer on mgmt_add_adv_patterns_monitor_complete
CVSS 7.8
CVE-2026-31504 HIGH
net: fix fanout UAF in packet_release() via NETDEV_UP race
CVSS 7.8
CVE-2026-31501 CRITICAL
net: ti: icssg-prueth: fix use-after-free of CPPI descriptor in RX path
CVSS 9.8
CVE-2026-31500 HIGH
Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock
CVSS 7.8
CVE-2026-31493 HIGH
Linux Kernel EFA RDMA - Completion Context Use-After-Free
CVSS 7.8
CVE-2026-31490 HIGH
Linux Kernel - Use-After-Free in Xe SR-IOV PF Migration Restore
CVSS 7.8
CVE-2026-31488 HIGH
drm/amd/display: Do not skip unrelated mode changes in DSC validation
CVSS 7.8
CVE-2026-31485 HIGH
Linux Kernel spi-fsl-lpspi - Teardown Use-After-Free
CVSS 7.8
CVE-2026-31474 HIGH
can: isotp: fix tx.buf use-after-free in isotp_sendmsg()
CVSS 7.8
CVE-2026-31473 HIGH
media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex
CVSS 7.8
CVE-2026-31469 HIGH
virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false
CVSS 7.8
CVE-2026-31455 HIGH
xfs: stop reclaim before pushing AIL during unmount
CVSS 7.8
CVE-2026-31454 HIGH
xfs: save ailp before dropping the AIL lock in push callbacks
CVSS 7.8
CVE-2026-31446 HIGH
ext4: fix use-after-free in update_super_work when racing with umount
CVSS 7.8
CVE-2026-31444 CRITICAL
ksmbd: fix use-after-free and NULL deref in smb_grant_oplock()
CVSS 9.8
CVE-2026-33259 MEDIUM
Concurrent modification of RPZ data can lead to denial of servce
CVSS 5.0
CVE-2026-5398 HIGH
Kernel use-after-free bug in the TIOCNOTTY handler
CVSS 8.4
Details
Vulnerabilities 7,478
Exploit Likelihood High