CWE-415
AllowedDouble Free
Abstraction: Variant · Status: Draft
The product calls free() twice on the same memory address.
1176 vulnerabilities reference this CWE, most recent first.
GHSA-5R2R-5WX4-7X33
Vulnerability from github – Published: 2023-07-06 19:24 – Updated: 2025-02-14 18:30A double-free flaw was found in the Linux kernel’s TUN/TAP device driver functionality in how a user registers the device when the register_netdevice function fails (NETDEV_REGISTER notifier). This flaw allows a local user to crash or potentially escalate their privileges on the system.
{
"affected": [],
"aliases": [
"CVE-2022-4744"
],
"database_specific": {
"cwe_ids": [
"CWE-415",
"CWE-460"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-03-30T21:15:00Z",
"severity": "HIGH"
},
"details": "A double-free flaw was found in the Linux kernel\u2019s TUN/TAP device driver functionality in how a user registers the device when the register_netdevice function fails (NETDEV_REGISTER notifier). This flaw allows a local user to crash or potentially escalate their privileges on the system.",
"id": "GHSA-5r2r-5wx4-7x33",
"modified": "2025-02-14T18:30:39Z",
"published": "2023-07-06T19:24:13Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-4744"
},
{
"type": "WEB",
"url": "https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=158b515f703e"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2023/05/msg00006.html"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20230526-0009"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/171912/CentOS-Stream-9-Missing-Kernel-Security-Fix.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-5R7W-J22R-58J4
Vulnerability from github – Published: 2025-01-06 18:31 – Updated: 2025-11-03 21:32In the Linux kernel, the following vulnerability has been resolved:
mtd: rawnand: fix double free in atmel_pmecc_create_user()
The "user" pointer was converted from being allocated with kzalloc() to being allocated by devm_kzalloc(). Calling kfree(user) will lead to a double free.
{
"affected": [],
"aliases": [
"CVE-2024-56766"
],
"database_specific": {
"cwe_ids": [
"CWE-415"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-06T17:15:43Z",
"severity": "HIGH"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmtd: rawnand: fix double free in atmel_pmecc_create_user()\n\nThe \"user\" pointer was converted from being allocated with kzalloc() to\nbeing allocated by devm_kzalloc(). Calling kfree(user) will lead to a\ndouble free.",
"id": "GHSA-5r7w-j22r-58j4",
"modified": "2025-11-03T21:32:04Z",
"published": "2025-01-06T18:31:04Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-56766"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/1562871ef613fa9492aa0310933eff785166a90e"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/3d825a241e65f7e3072978729e79d735ec40b80e"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/6ea15205d7e2b811fbbdf79783f686f58abfb4b7"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/ca9818554b0f33e87f38e4bfa2dac056692d46cc"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/d2f090ea57f8d6587e09d4066f740a8617767b3d"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/d8e4771f99c0400a1873235704b28bb803c83d17"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/dd45c87782738715d5e7c167f8dabf0814a7394a"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-5RF6-RG39-RMC3
Vulnerability from github – Published: 2026-10-13 15:32 – Updated: 2026-10-13 15:32FreeRDP 3.29.0 before 3.32.0 contains a double free in the client's async-update message proxy, which shallow-copies the parser-owned PolygonSC or PolygonCB points array when numPoints is zero, so both the queue consumer and parser cleanup free it. A malicious RDP server can send a point-bearing polygon order followed by a zero-point order to crash a client with +async-update enabled.
{
"affected": [],
"aliases": [
"CVE-2026-109943"
],
"database_specific": {
"cwe_ids": [
"CWE-415"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-13T14:17:32Z",
"severity": "HIGH"
},
"details": "FreeRDP 3.29.0 before 3.32.0 contains a double free in the client\u0027s async-update message proxy, which shallow-copies the parser-owned PolygonSC or PolygonCB points array when numPoints is zero, so both the queue consumer and parser cleanup free it. A malicious RDP server can send a point-bearing polygon order followed by a zero-point order to crash a client with +async-update enabled.",
"id": "GHSA-5rf6-rg39-rmc3",
"modified": "2026-10-13T15:32:22Z",
"published": "2026-10-13T15:32:22Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-pg3f-chj4-mrw6"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109943"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/freerdp-3.29.0-before-3.32.0-double-free-via-async-update-polygon-order"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-5V7V-HHR9-43WJ
Vulnerability from github – Published: 2026-07-25 12:31 – Updated: 2026-07-27 06:30In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix query_info() replay double-free
A response-bearing attempt can return a replayable error and free its response buffer. If SMB2_query_info_init() fails before the next send, cleanup retains the previous buffer type and frees that response again.
Reset response bookkeeping before each attempt to prevent the stale free.
{
"affected": [],
"aliases": [
"CVE-2026-64386"
],
"database_specific": {
"cwe_ids": [
"CWE-415"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-25T10:17:21Z",
"severity": "CRITICAL"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix query_info() replay double-free\n\nA response-bearing attempt can return a replayable error and free its\nresponse buffer. If SMB2_query_info_init() fails before the next send,\ncleanup retains the previous buffer type and frees that response again.\n\nReset response bookkeeping before each attempt to prevent the stale free.",
"id": "GHSA-5v7v-hhr9-43wj",
"modified": "2026-07-27T06:30:35Z",
"published": "2026-07-25T12:31:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64386"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/100fb7c455fa86d248b8bd7bb9de757c192870b4"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/2a88561d66eb855813cf004a0abe648bbb17de5e"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/3c81dda84799f76b42aec598564316e2964440db"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/89234773e8348918111aa15f6922b58cf3843364"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/f1add4acb656f5a82806a1ab0e63fed3d8b1bfca"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-5WFV-MPG7-6VCR
Vulnerability from github – Published: 2026-07-27 09:31 – Updated: 2026-10-19 21:35In the Linux kernel, the following vulnerability has been resolved:
nvmet-tcp: Fix potential UAF when ddgst mismatch
Shivam Kumar found via vulnerability testing: When data digest is enabled on an NVMe/TCP connection and a digest mismatch occurs on a non-final H2C_DATA PDU during an R2T-based data transfer, the digest error handler in nvmet_tcp_try_recv_ddgst() calls nvmet_req_uninit() — which performs percpu_ref_put() on the submission queue — but does NOT mark the command as completed. It does not set cqe->status, does not modify rbytes_done, and does not clear any flag. When the subsequent fatal error triggers queue teardown, nvmet_tcp_uninit_data_in_cmds() iterates all commands, checks nvmet_tcp_need_data_in() for each one, and finds that the already-uninited command still appears to need data (because rbytes_done < transfer_len and cqe->status == 0). It therefore calls nvmet_req_uninit() a second time on the same command — a double percpu_ref_put against a single percpu_ref_get.
{
"affected": [],
"aliases": [
"CVE-2026-64535"
],
"database_specific": {
"cwe_ids": [
"CWE-415"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-27T08:16:22Z",
"severity": "CRITICAL"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet-tcp: Fix potential UAF when ddgst mismatch\n\nShivam Kumar found via vulnerability testing:\nWhen data digest is enabled on an NVMe/TCP connection and a digest\nmismatch occurs on a non-final H2C_DATA PDU during an R2T-based\ndata transfer, the digest error handler in nvmet_tcp_try_recv_ddgst()\ncalls nvmet_req_uninit() \u2014 which performs percpu_ref_put() on the\nsubmission queue \u2014 but does NOT mark the command as completed. It\ndoes not set cqe-\u003estatus, does not modify rbytes_done, and does not\nclear any flag. When the subsequent fatal error triggers queue\nteardown, nvmet_tcp_uninit_data_in_cmds() iterates all commands,\nchecks nvmet_tcp_need_data_in() for each one, and finds that the\nalready-uninited command still appears to need data (because\nrbytes_done \u003c transfer_len and cqe-\u003estatus == 0). It therefore calls\nnvmet_req_uninit() a second time on the same command \u2014 a double\npercpu_ref_put against a single percpu_ref_get.",
"id": "GHSA-5wfv-mpg7-6vcr",
"modified": "2026-10-19T21:35:39Z",
"published": "2026-07-27T09:31:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64535"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/088ee46c18d99baef453afd74181dd40ade044ad"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/6f9442983a3e4227afd1c83a5251ddbca585ea21"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/7e558308eba14c8136cb1e615f0c850f76d1fc0a"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/96fe2513df590e74b04253a45089cae75569570e"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/dbbd07d0a7020b80f6a7028e561908f7b83b3d5a"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/dfb902462bca478f050224ec7a7195aafa7643b1"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/e091ff83d962f9ed00d9bd70443676de9fe98bdc"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-6325-FCFV-PXV6
Vulnerability from github – Published: 2026-06-24 18:32 – Updated: 2026-07-21 18:30In the Linux kernel, the following vulnerability has been resolved:
PCI: endpoint: pci-ep-msi: Fix error unwind and prevent double alloc
pci_epf_alloc_doorbell() stores the allocated doorbell message array in epf->db_msg/epf->num_db before requesting MSI vectors. If MSI allocation fails, the array is freed but the EPF state may still point to freed memory.
Clear epf->db_msg and epf->num_db on the MSI allocation failure path so that later cleanup cannot double-free the array and callers can retry allocation.
Also return -EBUSY when doorbells have already been allocated to prevent leaking or overwriting an existing allocation.
{
"affected": [],
"aliases": [
"CVE-2026-53067"
],
"database_specific": {
"cwe_ids": [
"CWE-415"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-24T17:17:19Z",
"severity": "HIGH"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nPCI: endpoint: pci-ep-msi: Fix error unwind and prevent double alloc\n\npci_epf_alloc_doorbell() stores the allocated doorbell message array in\nepf-\u003edb_msg/epf-\u003enum_db before requesting MSI vectors. If MSI allocation\nfails, the array is freed but the EPF state may still point to freed\nmemory.\n\nClear epf-\u003edb_msg and epf-\u003enum_db on the MSI allocation failure path so\nthat later cleanup cannot double-free the array and callers can retry\nallocation.\n\nAlso return -EBUSY when doorbells have already been allocated to prevent\nleaking or overwriting an existing allocation.",
"id": "GHSA-6325-fcfv-pxv6",
"modified": "2026-07-21T18:30:38Z",
"published": "2026-06-24T18:32:45Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53067"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/175717cfc06cab79f84cd037d66dda1b8564cd9e"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/1cba96c0a795124c3229293ed7b5b5765e66f259"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/3c25587fbf8797b92090b064a6d239a873e55fb1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-634Q-77FV-9CQ7
Vulnerability from github – Published: 2022-05-13 01:54 – Updated: 2022-05-13 01:54A double free when handling responses from an HSM Card in sc_pkcs15emu_sc_hsm_init in libopensc/pkcs15-sc-hsm.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.
{
"affected": [],
"aliases": [
"CVE-2018-16425"
],
"database_specific": {
"cwe_ids": [
"CWE-415"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-09-04T00:29:00Z",
"severity": "MODERATE"
},
"details": "A double free when handling responses from an HSM Card in sc_pkcs15emu_sc_hsm_init in libopensc/pkcs15-sc-hsm.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.",
"id": "GHSA-634q-77fv-9cq7",
"modified": "2022-05-13T01:54:14Z",
"published": "2022-05-13T01:54:14Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-16425"
},
{
"type": "WEB",
"url": "https://github.com/OpenSC/OpenSC/commit/360e95d45ac4123255a4c796db96337f332160ad#diff-d643a0fa169471dbf2912f4866dc49c5"
},
{
"type": "WEB",
"url": "https://github.com/OpenSC/OpenSC/releases/tag/0.19.0-rc1"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2019/09/msg00009.html"
},
{
"type": "WEB",
"url": "https://www.x41-dsec.de/lab/advisories/x41-2018-002-OpenSC"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-63Q9-9V3C-VGH4
Vulnerability from github – Published: 2026-09-09 03:30 – Updated: 2026-09-09 15:35Double free in PDFium in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted PDF file. (Chromium security severity: High)
{
"affected": [],
"aliases": [
"CVE-2026-87585"
],
"database_specific": {
"cwe_ids": [
"CWE-415"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-09T01:17:16Z",
"severity": "HIGH"
},
"details": "Double free in PDFium in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted PDF file. (Chromium security severity: High)",
"id": "GHSA-63q9-9v3c-vgh4",
"modified": "2026-09-09T15:35:02Z",
"published": "2026-09-09T03:30:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87585"
},
{
"type": "WEB",
"url": "https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html"
},
{
"type": "WEB",
"url": "https://issues.chromium.org/issues/540817065"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-63XR-9HMX-V966
Vulnerability from github – Published: 2025-01-03 18:30 – Updated: 2025-01-03 21:30FFmpeg version n6.1.1 has a double-free vulnerability in the fftools/ffmpeg_mux_init.c component of FFmpeg, specifically within the new_stream_audio function.
{
"affected": [],
"aliases": [
"CVE-2024-35365"
],
"database_specific": {
"cwe_ids": [
"CWE-415"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-03T18:15:15Z",
"severity": "HIGH"
},
"details": "FFmpeg version n6.1.1 has a double-free vulnerability in the fftools/ffmpeg_mux_init.c component of FFmpeg, specifically within the new_stream_audio function.",
"id": "GHSA-63xr-9hmx-v966",
"modified": "2025-01-03T21:30:40Z",
"published": "2025-01-03T18:30:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-35365"
},
{
"type": "WEB",
"url": "https://github.com/ffmpeg/ffmpeg/commit/ced5c5fdb8634d39ca9472a2026b2d2fea16c4e5"
},
{
"type": "WEB",
"url": "https://gist.github.com/1047524396/d7d4ea8055b75c4a9f9bbcff31d21423"
},
{
"type": "WEB",
"url": "https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/fftools/ffmpeg_mux_init.c#L886"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-64PH-QR47-QXH4
Vulnerability from github – Published: 2026-03-17 21:31 – Updated: 2026-03-17 21:31A specially crafted aggregation query with $lookup by an authenticated user with write privileges can cause a double-free or use-after-free memory issue in the slot-based execution (SBE) engine when an in-memory hash table is spilled to disk.
{
"affected": [],
"aliases": [
"CVE-2026-4358"
],
"database_specific": {
"cwe_ids": [
"CWE-415"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-03-17T20:16:15Z",
"severity": "MODERATE"
},
"details": "A specially crafted aggregation query with $lookup by an authenticated user with write privileges can cause a double-free or use-after-free memory issue in the slot-based execution (SBE) engine when an in-memory hash table is spilled to disk.",
"id": "GHSA-64ph-qr47-qxh4",
"modified": "2026-03-17T21:31:46Z",
"published": "2026-03-17T21:31:45Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4358"
},
{
"type": "WEB",
"url": "https://jira.mongodb.org/browse/SERVER-118849"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
Mitigation
Choose a language that provides automatic memory management.
Mitigation
Ensure that each allocation is freed only once. After freeing a chunk, set the pointer to NULL to ensure the pointer cannot be freed again. In complicated error conditions, be sure that clean-up routines respect the state of allocation properly. If the language is object oriented, ensure that object destructors delete each chunk of memory only once.
Mitigation
Use a static analysis tool to find double free instances.
No CAPEC attack patterns related to this CWE.