CWE-415
AllowedDouble Free
Abstraction: Variant · Status: Draft
The product calls free() twice on the same memory address.
1161 vulnerabilities reference this CWE, most recent first.
GHSA-W48V-5PP6-7H96
Vulnerability from github – Published: 2022-05-13 01:27 – Updated: 2022-05-13 01:27A double-free vulnerability in str2host.c in ldns 1.7.0 have unspecified impact and attack vectors.
{
"affected": [],
"aliases": [
"CVE-2017-1000232"
],
"database_specific": {
"cwe_ids": [
"CWE-415"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-11-17T04:29:00Z",
"severity": "CRITICAL"
},
"details": "A double-free vulnerability in str2host.c in ldns 1.7.0 have unspecified impact and attack vectors.",
"id": "GHSA-w48v-5pp6-7h96",
"modified": "2022-05-13T01:27:30Z",
"published": "2022-05-13T01:27:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-1000232"
},
{
"type": "WEB",
"url": "https://www.nlnetlabs.nl/bugs-script/show_bug.cgi?id=1257"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00000.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-W5JF-FRGQ-PHFP
Vulnerability from github – Published: 2026-07-25 12:31 – Updated: 2026-07-27 06:30In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix double-free in SMB2_ioctl() replay
A response-bearing attempt can return a replayable error and free its response buffer. If SMB2_ioctl_init() fails before the next send, cleanup retains the previous buffer type and frees that response again.
Reset response bookkeeping before each attempt to prevent the stale free.
{
"affected": [],
"aliases": [
"CVE-2026-64385"
],
"database_specific": {
"cwe_ids": [
"CWE-415"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-25T10:17:21Z",
"severity": "CRITICAL"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix double-free in SMB2_ioctl() replay\n\nA response-bearing attempt can return a replayable error and free its\nresponse buffer. If SMB2_ioctl_init() fails before the next send, cleanup\nretains the previous buffer type and frees that response again.\n\nReset response bookkeeping before each attempt to prevent the stale free.",
"id": "GHSA-w5jf-frgq-phfp",
"modified": "2026-07-27T06:30:35Z",
"published": "2026-07-25T12:31:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64385"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/0be4bc64882edaefaaee8d1e27d083643eb778e6"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/276c8efbc49f9303ac76d0d4deab7128581b0f3b"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/96fcfc8ae7359346156e492ca610e830d2649ad6"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/f9bbadb6c94583e3b4af1afc449bfceb1d1ddec9"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/fc65ffb4ef1bf540da16b17c225ae51091e07d72"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-W5MW-4W5V-8MGJ
Vulnerability from github – Published: 2022-05-24 19:04 – Updated: 2022-05-24 19:04In memory management driver, there is a possible memory corruption due to a double free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android SoCAndroid ID: A-183461321
{
"affected": [],
"aliases": [
"CVE-2021-0498"
],
"database_specific": {
"cwe_ids": [
"CWE-415"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-06-11T17:15:00Z",
"severity": "HIGH"
},
"details": "In memory management driver, there is a possible memory corruption due to a double free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android SoCAndroid ID: A-183461321",
"id": "GHSA-w5mw-4w5v-8mgj",
"modified": "2022-05-24T19:04:59Z",
"published": "2022-05-24T19:04:59Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-0498"
},
{
"type": "WEB",
"url": "https://source.android.com/security/bulletin/2021-05-01"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-W62J-G234-3F6F
Vulnerability from github – Published: 2023-02-03 06:30 – Updated: 2026-10-15 00:30OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. This is fixed in OpenSSH 9.2. The double free can be triggered by an unauthenticated attacker in the default configuration; however, the vulnerability discoverer reports that "exploiting this vulnerability will not be easy."
{
"affected": [],
"aliases": [
"CVE-2023-25136"
],
"database_specific": {
"cwe_ids": [
"CWE-415"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-02-03T06:15:00Z",
"severity": "CRITICAL"
},
"details": "OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. This is fixed in OpenSSH 9.2. The double free can be triggered by an unauthenticated attacker in the default configuration; however, the vulnerability discoverer reports that \"exploiting this vulnerability will not be easy.\"",
"id": "GHSA-w62j-g234-3f6f",
"modified": "2026-10-15T00:30:37Z",
"published": "2023-02-03T06:30:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-25136"
},
{
"type": "WEB",
"url": "https://github.com/openssh/openssh-portable/commit/486c4dc3b83b4b67d663fb0fa62bc24138ec3946"
},
{
"type": "WEB",
"url": "https://bugzilla.mindrot.org/show_bug.cgi?id=3522"
},
{
"type": "WEB",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-398330.html"
},
{
"type": "WEB",
"url": "https://ftp.openbsd.org/pub/OpenBSD/patches/7.2/common/017_sshd.patch.sig"
},
{
"type": "WEB",
"url": "https://jfrog.com/blog/openssh-pre-auth-double-free-cve-2023-25136-writeup-and-proof-of-concept"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JGAUIXJ3TEKCRKVWFQ6GDAGQFTIIGQQP"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R7LKQDFZWKYHQ65TBSH2X2HJQ4V2THS3"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JGAUIXJ3TEKCRKVWFQ6GDAGQFTIIGQQP"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/R7LKQDFZWKYHQ65TBSH2X2HJQ4V2THS3"
},
{
"type": "WEB",
"url": "https://news.ycombinator.com/item?id=34711565"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/202307-01"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20230309-0003"
},
{
"type": "WEB",
"url": "https://www.openwall.com/lists/oss-security/2023/02/02/2"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2023/02/13/1"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2023/02/22/1"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2023/02/22/2"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2023/02/23/3"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2023/03/06/1"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2023/03/09/2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-W6JM-J85G-VPGJ
Vulnerability from github – Published: 2026-05-06 12:30 – Updated: 2026-05-08 21:31In the Linux kernel, the following vulnerability has been resolved:
bnxt_en: Fix RSS context delete logic
We need to free the corresponding RSS context VNIC in FW everytime an RSS context is deleted in driver. Commit 667ac333dbb7 added a check to delete the VNIC in FW only when netif_running() is true to help delete RSS contexts with interface down.
Having that condition will make the driver leak VNICs in FW whenever close() happens with active RSS contexts. On the subsequent open(), as part of RSS context restoration, we will end up trying to create extra VNICs for which we did not make any reservation. FW can fail this request, thereby making us lose active RSS contexts.
Suppose an RSS context is deleted already and we try to process a delete request again, then the HWRM functions will check for validity of the request and they simply return if the resource is already freed. So, even for delete-when-down cases, netif_running() check is not necessary.
Remove the netif_running() condition check when deleting an RSS context.
{
"affected": [],
"aliases": [
"CVE-2026-43260"
],
"database_specific": {
"cwe_ids": [
"CWE-415"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-06T12:16:46Z",
"severity": "HIGH"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nbnxt_en: Fix RSS context delete logic\n\nWe need to free the corresponding RSS context VNIC\nin FW everytime an RSS context is deleted in driver.\nCommit 667ac333dbb7 added a check to delete the VNIC\nin FW only when netif_running() is true to help delete\nRSS contexts with interface down.\n\nHaving that condition will make the driver leak VNICs\nin FW whenever close() happens with active RSS contexts.\nOn the subsequent open(), as part of RSS context restoration,\nwe will end up trying to create extra VNICs for which we\ndid not make any reservation. FW can fail this request,\nthereby making us lose active RSS contexts.\n\nSuppose an RSS context is deleted already and we try to\nprocess a delete request again, then the HWRM functions\nwill check for validity of the request and they simply\nreturn if the resource is already freed. So, even for\ndelete-when-down cases, netif_running() check is not\nnecessary.\n\nRemove the netif_running() condition check when deleting\nan RSS context.",
"id": "GHSA-w6jm-j85g-vpgj",
"modified": "2026-05-08T21:31:21Z",
"published": "2026-05-06T12:30:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43260"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/079986d6db1f8e3d50c55f400cf998ac9690d2c8"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/348a5f8d06c7bdf954e13c17ad5f80b59a075604"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/9a9b89eea4a9cc7726702946ff688d716962fabd"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/e123d9302d223767bd910bfbcfe607bae909f8ac"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-W6PP-P9R9-CVM4
Vulnerability from github – Published: 2025-09-05 18:31 – Updated: 2025-11-26 00:30In the Linux kernel, the following vulnerability has been resolved:
i2c: core: Fix double-free of fwnode in i2c_unregister_device()
Before commit df6d7277e552 ("i2c: core: Do not dereference fwnode in struct device"), i2c_unregister_device() only called fwnode_handle_put() on of_node-s in the form of calling of_node_put(client->dev.of_node).
But after this commit the i2c_client's fwnode now unconditionally gets fwnode_handle_put() on it.
When the i2c_client has no primary (ACPI / OF) fwnode but it does have a software fwnode, the software-node will be the primary node and fwnode_handle_put() will put() it.
But for the software fwnode device_remove_software_node() will also put() it leading to a double free:
[ 82.665598] ------------[ cut here ]------------ [ 82.665609] refcount_t: underflow; use-after-free. [ 82.665808] WARNING: CPU: 3 PID: 1502 at lib/refcount.c:28 refcount_warn_saturate+0xba/0x11 ... [ 82.666830] RIP: 0010:refcount_warn_saturate+0xba/0x110 ... [ 82.666962] [ 82.666971] i2c_unregister_device+0x60/0x90
Fix this by not calling fwnode_handle_put() when the primary fwnode is a software-node.
{
"affected": [],
"aliases": [
"CVE-2025-38682"
],
"database_specific": {
"cwe_ids": [
"CWE-415"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-09-04T16:15:35Z",
"severity": "HIGH"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: core: Fix double-free of fwnode in i2c_unregister_device()\n\nBefore commit df6d7277e552 (\"i2c: core: Do not dereference fwnode in struct\ndevice\"), i2c_unregister_device() only called fwnode_handle_put() on\nof_node-s in the form of calling of_node_put(client-\u003edev.of_node).\n\nBut after this commit the i2c_client\u0027s fwnode now unconditionally gets\nfwnode_handle_put() on it.\n\nWhen the i2c_client has no primary (ACPI / OF) fwnode but it does have\na software fwnode, the software-node will be the primary node and\nfwnode_handle_put() will put() it.\n\nBut for the software fwnode device_remove_software_node() will also put()\nit leading to a double free:\n\n[ 82.665598] ------------[ cut here ]------------\n[ 82.665609] refcount_t: underflow; use-after-free.\n[ 82.665808] WARNING: CPU: 3 PID: 1502 at lib/refcount.c:28 refcount_warn_saturate+0xba/0x11\n...\n[ 82.666830] RIP: 0010:refcount_warn_saturate+0xba/0x110\n...\n[ 82.666962] \u003cTASK\u003e\n[ 82.666971] i2c_unregister_device+0x60/0x90\n\nFix this by not calling fwnode_handle_put() when the primary fwnode is\na software-node.",
"id": "GHSA-w6pp-p9r9-cvm4",
"modified": "2025-11-26T00:30:16Z",
"published": "2025-09-05T18:31:15Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-38682"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/1c24e5fc0c7096e00c202a6a3e0c342c1afb47c2"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/ffe02f7c4e36090154646612e67d331832f92037"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-W6RG-W5MQ-2RVV
Vulnerability from github – Published: 2025-11-11 18:30 – Updated: 2025-11-11 18:30Double free in Windows Smart Card allows an authorized attacker to elevate privileges locally.
{
"affected": [],
"aliases": [
"CVE-2025-59505"
],
"database_specific": {
"cwe_ids": [
"CWE-415"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-11-11T18:15:36Z",
"severity": "HIGH"
},
"details": "Double free in Windows Smart Card allows an authorized attacker to elevate privileges locally.",
"id": "GHSA-w6rg-w5mq-2rvv",
"modified": "2025-11-11T18:30:20Z",
"published": "2025-11-11T18:30:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59505"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59505"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-W7C8-V5H2-32FF
Vulnerability from github – Published: 2022-05-24 17:47 – Updated: 2022-05-24 17:47In the standard library in Rust before 1.49.0, VecDeque::make_contiguous has a bug that pops the same element more than once under certain condition. This bug could result in a use-after-free or double free.
{
"affected": [],
"aliases": [
"CVE-2020-36318"
],
"database_specific": {
"cwe_ids": [
"CWE-415"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-04-11T20:15:00Z",
"severity": "CRITICAL"
},
"details": "In the standard library in Rust before 1.49.0, VecDeque::make_contiguous has a bug that pops the same element more than once under certain condition. This bug could result in a use-after-free or double free.",
"id": "GHSA-w7c8-v5h2-32ff",
"modified": "2022-05-24T17:47:04Z",
"published": "2022-05-24T17:47:04Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-36318"
},
{
"type": "WEB",
"url": "https://github.com/rust-lang/rust/issues/79808"
},
{
"type": "WEB",
"url": "https://github.com/rust-lang/rust/pull/79814"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-W88P-XVMW-FXGG
Vulnerability from github – Published: 2022-05-24 17:12 – Updated: 2022-05-24 17:12GNU patch through 2.7.6 contains a free(p_line[p_end]) Double Free vulnerability in the function another_hunk in pch.c that can cause a denial of service via a crafted patch file. NOTE: this issue exists because of an incomplete fix for CVE-2018-6952.
{
"affected": [],
"aliases": [
"CVE-2019-20633"
],
"database_specific": {
"cwe_ids": [
"CWE-415"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-03-25T17:15:00Z",
"severity": "MODERATE"
},
"details": "GNU patch through 2.7.6 contains a free(p_line[p_end]) Double Free vulnerability in the function another_hunk in pch.c that can cause a denial of service via a crafted patch file. NOTE: this issue exists because of an incomplete fix for CVE-2018-6952.",
"id": "GHSA-w88p-xvmw-fxgg",
"modified": "2022-05-24T17:12:37Z",
"published": "2022-05-24T17:12:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-20633"
},
{
"type": "WEB",
"url": "https://savannah.gnu.org/bugs/index.php?56683"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-W8WP-RV4W-H5PP
Vulnerability from github – Published: 2023-02-28 18:30 – Updated: 2025-03-21 21:31Sudo before 1.9.13p2 has a double free in the per-command chroot feature.
{
"affected": [],
"aliases": [
"CVE-2023-27320"
],
"database_specific": {
"cwe_ids": [
"CWE-415"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-02-28T18:15:00Z",
"severity": "HIGH"
},
"details": "Sudo before 1.9.13p2 has a double free in the per-command chroot feature.",
"id": "GHSA-w8wp-rv4w-h5pp",
"modified": "2025-03-21T21:31:33Z",
"published": "2023-02-28T18:30:16Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-27320"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/332KN4QI6QXB7NI7SWSJ2EQJKWIILFN6"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FPLXMRAMXC3BYL4DNKVTK3V6JDMUXZ7B"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X6VW24YGXJYI4NZ5HZPQCF4MCE7766AU"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/332KN4QI6QXB7NI7SWSJ2EQJKWIILFN6"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FPLXMRAMXC3BYL4DNKVTK3V6JDMUXZ7B"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X6VW24YGXJYI4NZ5HZPQCF4MCE7766AU"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/202309-12"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20230413-0009"
},
{
"type": "WEB",
"url": "https://www.openwall.com/lists/oss-security/2023/02/28/1"
},
{
"type": "WEB",
"url": "https://www.sudo.ws/releases/stable/#1.9.13p2"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2023/03/01/8"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
Choose a language that provides automatic memory management.
Mitigation
Ensure that each allocation is freed only once. After freeing a chunk, set the pointer to NULL to ensure the pointer cannot be freed again. In complicated error conditions, be sure that clean-up routines respect the state of allocation properly. If the language is object oriented, ensure that object destructors delete each chunk of memory only once.
Mitigation
Use a static analysis tool to find double free instances.
No CAPEC attack patterns related to this CWE.