Filtered by CWE-416
Filtered by vendor Subscriptions
Total 7519 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2025-22077 1 Linux 1 Linux Kernel 2025-10-31 5.5 Medium
In the Linux kernel, the following vulnerability has been resolved: Revert "smb: client: fix TCP timers deadlock after rmmod" This reverts commit e9f2517a3e18a54a3943c098d2226b245d488801. Commit e9f2517a3e18 ("smb: client: fix TCP timers deadlock after rmmod") is intended to fix a null-ptr-deref in LOCKDEP, which is mentioned as CVE-2024-54680, but is actually did not fix anything; The issue can be reproduced on top of it. [0] Also, it reverted the change by commit ef7134c7fc48 ("smb: client: Fix use-after-free of network namespace.") and introduced a real issue by reviving the kernel TCP socket. When a reconnect happens for a CIFS connection, the socket state transitions to FIN_WAIT_1. Then, inet_csk_clear_xmit_timers_sync() in tcp_close() stops all timers for the socket. If an incoming FIN packet is lost, the socket will stay at FIN_WAIT_1 forever, and such sockets could be leaked up to net.ipv4.tcp_max_orphans. Usually, FIN can be retransmitted by the peer, but if the peer aborts the connection, the issue comes into reality. I warned about this privately by pointing out the exact report [1], but the bogus fix was finally merged. So, we should not stop the timers to finally kill the connection on our side in that case, meaning we must not use a kernel socket for TCP whose sk->sk_net_refcnt is 0. The kernel socket does not have a reference to its netns to make it possible to tear down netns without cleaning up every resource in it. For example, tunnel devices use a UDP socket internally, but we can destroy netns without removing such devices and let it complete during exit. Otherwise, netns would be leaked when the last application died. However, this is problematic for TCP sockets because TCP has timers to close the connection gracefully even after the socket is close()d. The lifetime of the socket and its netns is different from the lifetime of the underlying connection. If the socket user does not maintain the netns lifetime, the timer could be fired after the socket is close()d and its netns is freed up, resulting in use-after-free. Actually, we have seen so many similar issues and converted such sockets to have a reference to netns. That's why I converted the CIFS client socket to have a reference to netns (sk->sk_net_refcnt == 1), which is somehow mentioned as out-of-scope of CIFS and technically wrong in e9f2517a3e18, but **is in-scope and right fix**. Regarding the LOCKDEP issue, we can prevent the module unload by bumping the module refcount when switching the LOCKDDEP key in sock_lock_init_class_and_name(). [2] For a while, let's revert the bogus fix. Note that now we can use sk_net_refcnt_upgrade() for the socket conversion, but I'll do so later separately to make backport easy.
CVE-2025-21896 1 Linux 1 Linux Kernel 2025-10-31 7.8 High
In the Linux kernel, the following vulnerability has been resolved: fuse: revert back to __readahead_folio() for readahead In commit 3eab9d7bc2f4 ("fuse: convert readahead to use folios"), the logic was converted to using the new folio readahead code, which drops the reference on the folio once it is locked, using an inferred reference on the folio. Previously we held a reference on the folio for the entire duration of the readpages call. This is fine, however for the case for splice pipe responses where we will remove the old folio and splice in the new folio (see fuse_try_move_page()), we assume that there is a reference held on the folio for ap->folios, which is no longer the case. To fix this, revert back to __readahead_folio() which allows us to hold the reference on the folio for the duration of readpages until either we drop the reference ourselves in fuse_readpages_end() or the reference is dropped after it's replaced in the page cache in the splice case. This will fix the UAF bug that was reported.
CVE-2020-4004 2 Apple, Vmware 5 Mac Os X, Cloud Foundation, Esxi and 2 more 2025-10-31 8.2 High
VMware ESXi (7.0 before ESXi70U1b-17168206, 6.7 before ESXi670-202011101-SG, 6.5 before ESXi650-202011301-SG), Workstation (15.x before 15.5.7), Fusion (11.x before 11.5.7) contain a use-after-free vulnerability in the XHCI USB controller. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host.
CVE-2021-22893 1 Ivanti 1 Connect Secure 2025-10-30 10 Critical
Pulse Connect Secure 9.0R3/9.1R1 and higher is vulnerable to an authentication bypass vulnerability exposed by the Windows File Share Browser and Pulse Secure Collaboration features of Pulse Connect Secure that can allow an unauthenticated user to perform remote arbitrary code execution on the Pulse Connect Secure gateway. This vulnerability has been exploited in the wild.
CVE-2020-3992 1 Vmware 2 Cloud Foundation, Esxi 2025-10-30 9.8 Critical
OpenSLP as used in VMware ESXi (7.0 before ESXi_7.0.1-0.0.16850804, 6.7 before ESXi670-202010401-SG, 6.5 before ESXi650-202010401-SG) has a use-after-free issue. A malicious actor residing in the management network who has access to port 427 on an ESXi machine may be able to trigger a use-after-free in the OpenSLP service resulting in remote code execution.
CVE-2021-26411 1 Microsoft 16 Edge, Internet Explorer, Windows 10 1507 and 13 more 2025-10-30 8.8 High
Internet Explorer Memory Corruption Vulnerability
CVE-2021-31166 1 Microsoft 7 Windows 10 1809, Windows 10 2004, Windows 10 20h2 and 4 more 2025-10-30 9.8 Critical
HTTP Protocol Stack Remote Code Execution Vulnerability
CVE-2023-21674 1 Microsoft 20 Windows 10 1507, Windows 10 1607, Windows 10 1809 and 17 more 2025-10-30 8.8 High
Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability
CVE-2021-40449 1 Microsoft 26 Windows 10 1507, Windows 10 1607, Windows 10 1809 and 23 more 2025-10-30 7.8 High
Win32k Elevation of Privilege Vulnerability
CVE-2021-34486 1 Microsoft 11 Windows 10 1809, Windows 10 1909, Windows 10 2004 and 8 more 2025-10-30 7.8 High
Windows Event Tracing Elevation of Privilege Vulnerability
CVE-2023-36760 1 Microsoft 1 3d Viewer 2025-10-30 7.8 High
3D Viewer Remote Code Execution Vulnerability
CVE-2023-38160 1 Microsoft 12 Windows 10 1507, Windows 10 1607, Windows 10 1809 and 9 more 2025-10-30 5.5 Medium
Windows TCP/IP Information Disclosure Vulnerability
CVE-2023-36735 1 Microsoft 1 Edge Chromium 2025-10-30 9.6 Critical
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
CVE-2023-36562 1 Microsoft 1 Edge Chromium 2025-10-30 7.1 High
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
CVE-2023-36802 1 Microsoft 11 Windows 10 1809, Windows 10 21h2, Windows 10 21h2 and 8 more 2025-10-30 7.8 High
Microsoft Streaming Service Proxy Elevation of Privilege Vulnerability
CVE-2023-36804 1 Microsoft 12 Windows 10 1507, Windows 10 1607, Windows 10 1809 and 9 more 2025-10-30 7.8 High
Windows GDI Elevation of Privilege Vulnerability
CVE-2023-38139 1 Microsoft 12 Windows 10 1507, Windows 10 1607, Windows 10 1809 and 9 more 2025-10-30 7.8 High
Windows Kernel Elevation of Privilege Vulnerability
CVE-2023-38161 1 Microsoft 12 Windows 10 1507, Windows 10 1607, Windows 10 1809 and 9 more 2025-10-30 7.8 High
Windows GDI Elevation of Privilege Vulnerability
CVE-2020-35906 1 Rust-lang 1 Futures-task 2025-10-30 7.8 High
An issue was discovered in the futures-task crate before 0.3.6 for Rust. futures_task::waker may cause a use-after-free in a non-static type situation.
CVE-2025-62490 2 Quickjs-ng, Quickjs Project 2 Quickjs, Quickjs 2025-10-30 8.8 High
In quickjs, in js_print_object, when printing an array, the function first fetches the array length and then loops over it. The issue is, printing a value is not side-effect free. An attacker-defined callback could run during js_print_value, during which the array could get resized and len1 become out of bounds. This results in a use-after-free.A second instance occurs in the same function during printing of a map or set objects. The code iterates over ms->records list, but once again, elements could be removed from the list during js_print_value call.