CWE-415

{
  "affected": [],
  "aliases": [
    "CVE-2026-46279"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-415"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-06-08T17:16:45Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/alloc_tag: clear codetag for pages allocated before page_ext initialization\n\nDue to initialization ordering, page_ext is allocated and initialized\nrelatively late during boot.  Some pages have already been allocated and\nfreed before page_ext becomes available, leaving their codetag\nuninitialized.\n\nA clear example is in init_section_page_ext(): alloc_page_ext() calls\nkmemleak_alloc().  If the slab cache has no free objects, it falls back to\nthe buddy allocator to allocate memory.  However, at this point page_ext\nis not yet fully initialized, so these newly allocated pages have no\ncodetag set.  These pages may later be reclaimed by KASAN, which causes\nthe warning to trigger when they are freed because their codetag ref is\nstill empty.\n\nUse a global array to track pages allocated before page_ext is fully\ninitialized.  The array size is fixed at 8192 entries, and will emit a\nwarning if this limit is exceeded.  When page_ext initialization\ncompletes, set their codetag to empty to avoid warnings when they are\nfreed later.\n\nThis warning is only observed with CONFIG_MEM_ALLOC_PROFILING_DEBUG=Y and\nmem_profiling_compressed disabled:\n\n[    9.582133] ------------[ cut here ]------------\n[    9.582137] alloc_tag was not set\n[    9.582139] WARNING: ./include/linux/alloc_tag.h:164 at __pgalloc_tag_sub+0x40f/0x550, CPU#5: systemd/1\n[    9.582190] CPU: 5 UID: 0 PID: 1 Comm: systemd Not tainted 7.0.0-rc4 #1 PREEMPT(lazy)\n[    9.582192] Hardware name: Red Hat KVM, BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014\n[    9.582194] RIP: 0010:__pgalloc_tag_sub+0x40f/0x550\n[    9.582196] Code: 00 00 4c 29 e5 48 8b 05 1f 88 56 05 48 8d 4c ad 00 48 8d 2c c8 e9 87 fd ff ff 0f 0b 0f 0b e9 f3 fe ff ff 48 8d 3d 61 2f ed 03 \u003c67\u003e 48 0f b9 3a e9 b3 fd ff ff 0f 0b eb e4 e8 5e cd 14 02 4c 89 c7\n[    9.582197] RSP: 0018:ffffc9000001f940 EFLAGS: 00010246\n[    9.582200] RAX: dffffc0000000000 RBX: 1ffff92000003f2b RCX: 1ffff110200d806c\n[    9.582201] RDX: ffff8881006c0360 RSI: 0000000000000004 RDI: ffffffff9bc7b460\n[    9.582202] RBP: 0000000000000000 R08: 0000000000000000 R09: fffffbfff3a62324\n[    9.582203] R10: ffffffff9d311923 R11: 0000000000000000 R12: ffffea0004001b00\n[    9.582204] R13: 0000000000002000 R14: ffffea0000000000 R15: ffff8881006c0360\n[    9.582206] FS:  00007ffbbcf2d940(0000) GS:ffff888450479000(0000) knlGS:0000000000000000\n[    9.582208] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[    9.582210] CR2: 000055ee3aa260d0 CR3: 0000000148b67005 CR4: 0000000000770ef0\n[    9.582211] PKRU: 55555554\n[    9.582212] Call Trace:\n[    9.582213]  \u003cTASK\u003e\n[    9.582214]  ? __pfx___pgalloc_tag_sub+0x10/0x10\n[    9.582216]  ? check_bytes_and_report+0x68/0x140\n[    9.582219]  __free_frozen_pages+0x2e4/0x1150\n[    9.582221]  ? __free_slab+0xc2/0x2b0\n[    9.582224]  qlist_free_all+0x4c/0xf0\n[    9.582227]  kasan_quarantine_reduce+0x15d/0x180\n[    9.582229]  __kasan_slab_alloc+0x69/0x90\n[    9.582232]  kmem_cache_alloc_noprof+0x14a/0x500\n[    9.582234]  do_getname+0x96/0x310\n[    9.582237]  do_readlinkat+0x91/0x2f0\n[    9.582239]  ? __pfx_do_readlinkat+0x10/0x10\n[    9.582240]  ? get_random_bytes_user+0x1df/0x2c0\n[    9.582244]  __x64_sys_readlinkat+0x96/0x100\n[    9.582246]  do_syscall_64+0xce/0x650\n[    9.582250]  ? __x64_sys_getrandom+0x13a/0x1e0\n[    9.582252]  ? __pfx___x64_sys_getrandom+0x10/0x10\n[    9.582254]  ? do_syscall_64+0x114/0x650\n[    9.582255]  ? ksys_read+0xfc/0x1d0\n[    9.582258]  ? __pfx_ksys_read+0x10/0x10\n[    9.582260]  ? do_syscall_64+0x114/0x650\n[    9.582262]  ? do_syscall_64+0x114/0x650\n[    9.582264]  ? __pfx_fput_close_sync+0x10/0x10\n[    9.582266]  ? file_close_fd_locked+0x178/0x2a0\n[    9.582268]  ? __x64_sys_faccessat2+0x96/0x100\n[    9.582269]  ? __x64_sys_close+0x7d/0xd0\n[    9.582271]  ? do_syscall_64+0x114/0x650\n[    9.582273]  ? do_syscall_64+0x114/0x650\n[    9.582275]  ? clear_bhb_loop+0x50/0xa0\n[    9.582277]  ? clear_bhb_l\n---truncated---",
  "id": "GHSA-q7fc-6xm7-37m9",
  "modified": "2026-07-08T15:31:35Z",
  "published": "2026-06-08T18:31:51Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46279"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/6b1842775a460245e97d36d3a67d0cfba7c4ff79"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/b49dfabc38cad5e50af24f63edd124a10de3ebb6"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/d5b495ba9de0423ef39f8bd86729a885870c7efe"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-80080"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-415"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-08T18:20:50Z",
    "severity": "HIGH"
  },
  "details": "Double free in Microsoft Office Word allows an unauthorized attacker to execute code over a network.",
  "id": "GHSA-q866-xwxr-5453",
  "modified": "2026-09-08T18:33:28Z",
  "published": "2026-09-08T18:33:28Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-80080"
    },
    {
      "type": "WEB",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-80080"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-62889"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-415"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-11T17:18:40Z",
    "severity": "HIGH"
  },
  "details": "Double free in Windows Secure Socket Tunneling Protocol (SSTP) allows an unauthorized attacker to execute code over a network.",
  "id": "GHSA-q8hj-9894-q2w9",
  "modified": "2026-08-11T18:31:28Z",
  "published": "2026-08-11T18:31:28Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-62889"
    },
    {
      "type": "WEB",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62889"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-79907"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-415"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-08T21:18:42Z",
    "severity": "HIGH"
  },
  "details": "Acrobat Reader is affected by a Double Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.",
  "id": "GHSA-q8qg-f338-5g6r",
  "modified": "2026-09-08T21:34:31Z",
  "published": "2026-09-08T21:34:31Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-79907"
    },
    {
      "type": "WEB",
      "url": "https://helpx.adobe.com/security/products/acrobat/apsb26-141.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-37933"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-415"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-05-20T16:15:29Z",
    "severity": "MODERATE"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nocteon_ep: Fix host hang issue during device reboot\n\nWhen the host loses heartbeat messages from the device,\nthe driver calls the device-specific ndo_stop function,\nwhich frees the resources. If the driver is unloaded in\nthis scenario, it calls ndo_stop again, attempting to free\nresources that have already been freed, leading to a host\nhang issue. To resolve this, dev_close should be called\ninstead of the device-specific stop function.dev_close\ninternally calls ndo_stop to stop the network interface\nand performs additional cleanup tasks. During the driver\nunload process, if the device is already down, ndo_stop\nis not called.",
  "id": "GHSA-q8rr-8fcc-gc56",
  "modified": "2025-11-17T15:30:31Z",
  "published": "2025-05-20T18:30:55Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-37933"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/34f42736b325287a7b2ce37e415838f539767bda"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/6d1052423518e7d0aece9af5e77bbc324face8f1"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/7e1ca1bed3f66e00377f7d2147be390144924276"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/c8d788f800f83b94d9db8b3dacc1d26be38a6ef4"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-2027"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-415"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-03-28T06:15:33Z",
    "severity": "MODERATE"
  },
  "details": "A double free vulnerability has been identified in the ASUS System Analysis service. This vulnerability can be triggered by sending specially crafted local RPC requests, leading to the service crash and potentially memory manipulation in some rare circumstances.\nRefer to the \u0027Security Update for MyASUS\u0027 section on the ASUS Security Advisory for more information.",
  "id": "GHSA-q92g-r34h-wrx3",
  "modified": "2025-03-28T06:30:27Z",
  "published": "2025-03-28T06:30:27Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2027"
    },
    {
      "type": "WEB",
      "url": "https://www.asus.com/content/asus-product-security-advisory"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-64447"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-415"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-25T10:17:29Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: media: ipu7: fix double-free and use-after-free in error paths\n\nIn both ipu7_isys_init() and ipu7_psys_init(), pdata is allocated and\nthen passed to ipu7_bus_initialize_device(), which stores it in\nadev-\u003epdata. The ipu7_bus_release() function frees adev-\u003epdata when the\ndevice\u0027s reference count drops to zero.\n\nTwo error paths incorrectly call kfree(pdata) after the device teardown\nhas already freed it:\n\n1. When ipu7_mmu_init() fails: put_device() is called, which drops the\n   reference count to zero and triggers ipu7_bus_release() -\u003e\n   kfree(pdata). The subsequent kfree(pdata) is a double-free.\n\n2. When ipu7_bus_add_device() fails: it calls auxiliary_device_uninit()\n   internally, which calls put_device() -\u003e ipu7_bus_release() -\u003e\n   kfree(pdata). The subsequent kfree(pdata) is again a double-free.\n\nNote that the kfree(pdata) when ipu7_bus_initialize_device() itself\nfails is correct, because in that case auxiliary_device_init() failed\nand the release function was never set up, so pdata must be freed\nmanually.\n\nAdditionally, the error code was not saved before calling put_device(),\ncausing ERR_CAST() to dereference the already-freed adev pointer when\nconstructing the return value. Fix this by saving the error from\ndev_err_probe() before put_device() and returning ERR_PTR() instead.\n\nRemove the redundant kfree(pdata) calls and fix the use-after-free in\nthe return values of the two affected error paths.",
  "id": "GHSA-q956-6h2r-2rpx",
  "modified": "2026-07-27T06:30:38Z",
  "published": "2026-07-25T12:31:36Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64447"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/837c1f9655421055f751ed34745e820a54a27642"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/b5ddc7257bee71f5b8cf9083e2b0ac0427e9fbb3"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/d3a9a8cf2d7fd61a2f63df61f6cbc0a9bb007cc0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-23387"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-415"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-03-25T11:16:39Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\npinctrl: cirrus: cs42l43: Fix double-put in cs42l43_pin_probe()\n\ndevm_add_action_or_reset() already invokes the action on failure,\nso the explicit put causes a double-put.",
  "id": "GHSA-q9cp-3qrm-w4v3",
  "modified": "2026-04-24T21:31:57Z",
  "published": "2026-03-25T12:30:24Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-23387"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/188ba3468cb7c098c62609d82e9fc58d29ead7f4"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/1e0465139fd9caee7ffefe285ef7d5f21919e474"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/95b14ecc56881dd9a187e1e84dd0daa88ff22c5d"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/ea07fcfbba4301839db3784f09955d9fa3e98090"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/fd5bed798f45eb3a178ad527b43ab92705faaf8a"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "alpm-rs"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "0.1.24"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2020-35885"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-415"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2021-08-19T20:56:12Z",
    "nvd_published_at": "2020-12-31T10:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "An issue was discovered in the alpm-rs crate through 2020-08-20 for Rust. StrcCtx performs improper memory deallocation.",
  "id": "GHSA-qc4m-gc8r-mg8m",
  "modified": "2021-08-19T20:56:12Z",
  "published": "2021-08-25T20:48:59Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-35885"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pigeonhands/rust-arch/issues/2"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/BahNahNah/rust-arch/tree/master/alpm-rs"
    },
    {
      "type": "WEB",
      "url": "https://rustsec.org/advisories/RUSTSEC-2020-0032.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Double free in alpm-rs"
}

{
  "affected": [],
  "aliases": [
    "CVE-2004-0772"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-119",
      "CWE-415"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2004-10-20T04:00:00Z",
    "severity": "HIGH"
  },
  "details": "Double free vulnerabilities in error handling code in krb524d for MIT Kerberos 5 (krb5) 1.2.8 and earlier may allow remote attackers to execute arbitrary code.",
  "id": "GHSA-qcm3-q3pj-vw39",
  "modified": "2025-04-03T04:01:28Z",
  "published": "2022-04-29T02:58:20Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2004-0772"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/17158"
    },
    {
      "type": "WEB",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A4661"
    },
    {
      "type": "WEB",
      "url": "http://distro.conectiva.com.br/atualizacoes/?id=a\u0026anuncio=000860"
    },
    {
      "type": "WEB",
      "url": "http://marc.info/?l=bugtraq\u0026m=109508872524753\u0026w=2"
    },
    {
      "type": "WEB",
      "url": "http://web.mit.edu/kerberos/www/advisories/MITKRB5-SA-2004-002-dblfree.txt"
    },
    {
      "type": "WEB",
      "url": "http://www.debian.org/security/2004/dsa-543"
    },
    {
      "type": "WEB",
      "url": "http://www.gentoo.org/security/en/glsa/glsa-200409-09.xml"
    },
    {
      "type": "WEB",
      "url": "http://www.kb.cert.org/vuls/id/350792"
    },
    {
      "type": "WEB",
      "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2004:088"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/11078"
    },
    {
      "type": "WEB",
      "url": "http://www.trustix.net/errata/2004/0045"
    },
    {
      "type": "WEB",
      "url": "http://www.us-cert.gov/cas/techalerts/TA04-247A.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}