CWE-401
AllowedMissing Release of Memory after Effective Lifetime
Abstraction: Variant · Status: Draft
The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.
2187 vulnerabilities reference this CWE, most recent first.
GHSA-69CC-M82H-X8RM
Vulnerability from github – Published: 2026-07-01 00:34 – Updated: 2026-07-01 00:34An unauthenticated remote attacker can repeatedly send a single crafted connection request to leak memory. Against storescp in its default single-process mode, memory grows quickly and the service is eventually killed, after which it stops accepting connections until an operator restarts it.
{
"affected": [],
"aliases": [
"CVE-2026-50254"
],
"database_specific": {
"cwe_ids": [
"CWE-401"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-30T22:16:57Z",
"severity": "HIGH"
},
"details": "An unauthenticated remote attacker can repeatedly send a single crafted connection request to leak memory. Against storescp in its default single-process mode, memory grows quickly and the service is eventually killed, after which it stops accepting connections until an operator restarts it.",
"id": "GHSA-69cc-m82h-x8rm",
"modified": "2026-07-01T00:34:00Z",
"published": "2026-07-01T00:34:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50254"
},
{
"type": "WEB",
"url": "https://github.com/DCMTK/dcmtk/releases/tag/latest"
},
{
"type": "WEB",
"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsma-26-181-01.json"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-181-01"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-69M6-GCW2-M2RP
Vulnerability from github – Published: 2026-05-06 12:30 – Updated: 2026-05-08 21:31In the Linux kernel, the following vulnerability has been resolved:
media: pvrusb2: fix URB leak in pvr2_send_request_ex
When pvr2_send_request_ex() submits a write URB successfully but fails to submit the read URB (e.g. returns -ENOMEM), it returns immediately without waiting for the write URB to complete. Since the driver reuses the same URB structure, a subsequent call to pvr2_send_request_ex() attempts to submit the still-active write URB, triggering a 'URB submitted while active' warning in usb_submit_urb().
Fix this by ensuring the write URB is unlinked and waited upon if the read URB submission fails.
{
"affected": [],
"aliases": [
"CVE-2026-43223"
],
"database_specific": {
"cwe_ids": [
"CWE-401"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-06T12:16:42Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: pvrusb2: fix URB leak in pvr2_send_request_ex\n\nWhen pvr2_send_request_ex() submits a write URB successfully but fails to\nsubmit the read URB (e.g. returns -ENOMEM), it returns immediately without\nwaiting for the write URB to complete. Since the driver reuses the same\nURB structure, a subsequent call to pvr2_send_request_ex() attempts to\nsubmit the still-active write URB, triggering a \u0027URB submitted while\nactive\u0027 warning in usb_submit_urb().\n\nFix this by ensuring the write URB is unlinked and waited upon if the read\nURB submission fails.",
"id": "GHSA-69m6-gcw2-m2rp",
"modified": "2026-05-08T21:31:20Z",
"published": "2026-05-06T12:30:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43223"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/2011929f0e4cf6a0a34dd6205911b12276904453"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/4ba5c7a1aade7090172cbffd4d120bf4cf5ccbde"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/58dd722b6c3debcddb4684fb256c90fee7f063e5"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/5f3ac816861c3b8a5d1a3645b17dc3a99d668d94"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/77a63f8efc434ddb04667ed632aade58301a2f13"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/a8333c8262aed2aedf608c18edd39cf5342680a7"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/cf459d6ffa5e150ef3744b897f936ff24b52bd15"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/da524c939b1e5ba17f10db4bde4bdaf569ffcda6"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-69MP-FMHX-FPWV
Vulnerability from github – Published: 2025-10-22 18:30 – Updated: 2025-10-22 18:30In the Linux kernel, the following vulnerability has been resolved:
drivers/base/node.c: fix compaction sysfs file leak
Compaction sysfs file is created via compaction_register_node in register_node. But we forgot to remove it in unregister_node. Thus compaction sysfs file is leaked. Using compaction_unregister_node to fix this issue.
{
"affected": [],
"aliases": [
"CVE-2022-49442"
],
"database_specific": {
"cwe_ids": [
"CWE-401"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-26T07:01:20Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrivers/base/node.c: fix compaction sysfs file leak\n\nCompaction sysfs file is created via compaction_register_node in\nregister_node. But we forgot to remove it in unregister_node. Thus\ncompaction sysfs file is leaked. Using compaction_unregister_node to fix\nthis issue.",
"id": "GHSA-69mp-fmhx-fpwv",
"modified": "2025-10-22T18:30:31Z",
"published": "2025-10-22T18:30:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-49442"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/386e69e068177ee91cac27f2f0e6ebda1515f5ca"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/39642b0feddb9c39faa6de469a94bfeb4dc0d3a9"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/466134df7561aeb801baddf6666b512e0e1a1707"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/606732650a2c88e66c59c22dd5464ea0d820250e"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/6905be93d1ab54f73718047536fec0ca488d5315"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/b3fcf1f583b1a0946d9d9bfb7362c9c186801775"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/d8a5bdc767f17281da648555cdbd286f98fd98ee"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/da63dc84befaa9e6079a0bc363ff0eaa975f9073"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/f76ddc8fcf6d81fe89bfa4d3efcbc4fe69a91d48"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-69P9-57RX-5P5P
Vulnerability from github – Published: 2022-05-13 01:10 – Updated: 2022-05-13 01:10In ImageMagick before 7.0.8-25, a memory leak exists in WriteDIBImage in coders/dib.c.
{
"affected": [],
"aliases": [
"CVE-2019-7398"
],
"database_specific": {
"cwe_ids": [
"CWE-401"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-02-05T00:29:00Z",
"severity": "HIGH"
},
"details": "In ImageMagick before 7.0.8-25, a memory leak exists in WriteDIBImage in coders/dib.c.",
"id": "GHSA-69p9-57rx-5p5p",
"modified": "2022-05-13T01:10:30Z",
"published": "2022-05-13T01:10:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-7398"
},
{
"type": "WEB",
"url": "https://github.com/ImageMagick/ImageMagick/issues/1453"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/4034-1"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2020/dsa-4712"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00034.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00006.html"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/106848"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-69R7-9RPM-Q977
Vulnerability from github – Published: 2023-01-05 15:30 – Updated: 2023-01-11 21:30GPAC version 2.1-DEV-rev505-gb9577e6ad-master was discovered to contain a memory leak via the afrt_box_read function at box_code_adobe.c.
{
"affected": [],
"aliases": [
"CVE-2022-46490"
],
"database_specific": {
"cwe_ids": [
"CWE-401"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-01-05T15:15:00Z",
"severity": "MODERATE"
},
"details": "GPAC version 2.1-DEV-rev505-gb9577e6ad-master was discovered to contain a memory leak via the afrt_box_read function at box_code_adobe.c.",
"id": "GHSA-69r7-9rpm-q977",
"modified": "2023-01-11T21:30:40Z",
"published": "2023-01-05T15:30:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-46490"
},
{
"type": "WEB",
"url": "https://github.com/gpac/gpac/issues/2327"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-6C7Q-3HQ7-HF68
Vulnerability from github – Published: 2022-11-02 12:00 – Updated: 2022-11-03 12:00A vulnerability was found in Axiomatic Bento4. It has been rated as problematic. Affected by this issue is the function AP4_ContainerAtom::AP4_ContainerAtom of the component mp4encrypt. The manipulation leads to memory leak. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-212678 is the identifier assigned to this vulnerability.
{
"affected": [],
"aliases": [
"CVE-2022-3812"
],
"database_specific": {
"cwe_ids": [
"CWE-401",
"CWE-404"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-11-01T22:15:00Z",
"severity": "MODERATE"
},
"details": "A vulnerability was found in Axiomatic Bento4. It has been rated as problematic. Affected by this issue is the function AP4_ContainerAtom::AP4_ContainerAtom of the component mp4encrypt. The manipulation leads to memory leak. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-212678 is the identifier assigned to this vulnerability.",
"id": "GHSA-6c7q-3hq7-hf68",
"modified": "2022-11-03T12:00:32Z",
"published": "2022-11-02T12:00:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3812"
},
{
"type": "WEB",
"url": "https://github.com/axiomatic-systems/Bento4/issues/792"
},
{
"type": "WEB",
"url": "https://github.com/axiomatic-systems/Bento4/files/9726934/POC_mp4encrypt_631000973.zip"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.212678"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-6C8G-Q98P-W229
Vulnerability from github – Published: 2026-04-22 15:31 – Updated: 2026-05-06 21:31In the Linux kernel, the following vulnerability has been resolved:
mm/damon/sysfs: fix param_ctx leak on damon_sysfs_new_test_ctx() failure
Patch series "mm/damon/sysfs: fix memory leak and NULL dereference issues", v4.
DAMON_SYSFS can leak memory under allocation failure, and do NULL pointer dereference when a privileged user make wrong sequences of control. Fix those.
This patch (of 3):
When damon_sysfs_new_test_ctx() fails in damon_sysfs_commit_input(), param_ctx is leaked because the early return skips the cleanup at the out label. Destroy param_ctx before returning.
{
"affected": [],
"aliases": [
"CVE-2026-31459"
],
"database_specific": {
"cwe_ids": [
"CWE-401"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-04-22T14:16:41Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/damon/sysfs: fix param_ctx leak on damon_sysfs_new_test_ctx() failure\n\nPatch series \"mm/damon/sysfs: fix memory leak and NULL dereference\nissues\", v4.\n\nDAMON_SYSFS can leak memory under allocation failure, and do NULL pointer\ndereference when a privileged user make wrong sequences of control. Fix\nthose.\n\n\nThis patch (of 3):\n\nWhen damon_sysfs_new_test_ctx() fails in damon_sysfs_commit_input(),\nparam_ctx is leaked because the early return skips the cleanup at the out\nlabel. Destroy param_ctx before returning.",
"id": "GHSA-6c8g-q98p-w229",
"modified": "2026-05-06T21:31:29Z",
"published": "2026-04-22T15:31:41Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-31459"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/7fe000eb32904758a85e62f6ea9483f89d5dabfc"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/e9de9f3ce06b133a348006668bc8d25c6e504867"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/f76f0a964bc3d7b7e253b43c669c41356bc54e71"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-6CCP-3692-J6FR
Vulnerability from github – Published: 2024-03-02 00:31 – Updated: 2024-12-12 15:31In the Linux kernel, the following vulnerability has been resolved:
nvme-loop: fix memory leak in nvme_loop_create_ctrl()
When creating loop ctrl in nvme_loop_create_ctrl(), if nvme_init_ctrl() fails, the loop ctrl should be freed before jumping to the "out" label.
{
"affected": [],
"aliases": [
"CVE-2021-47074"
],
"database_specific": {
"cwe_ids": [
"CWE-401"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-01T22:15:47Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme-loop: fix memory leak in nvme_loop_create_ctrl()\n\nWhen creating loop ctrl in nvme_loop_create_ctrl(), if nvme_init_ctrl()\nfails, the loop ctrl should be freed before jumping to the \"out\" label.",
"id": "GHSA-6ccp-3692-j6fr",
"modified": "2024-12-12T15:31:05Z",
"published": "2024-03-02T00:31:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47074"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/03504e3b54cc8118cc26c064e60a0b00c2308708"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/551ba08d4b7eb26f75758cdb9f15105b276517ad"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/9c980795ccd77e8abec33dd6fe28dfe1c4083e65"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-6CF7-F54V-7VJM
Vulnerability from github – Published: 2023-05-09 18:30 – Updated: 2024-04-04 03:55An issue found in libming v.0.4.8 allows a local attacker to execute arbitrary code via the parseSWF_IMPORTASSETS function in the parser.c file.
{
"affected": [],
"aliases": [
"CVE-2021-31240"
],
"database_specific": {
"cwe_ids": [
"CWE-401"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-05-09T16:15:14Z",
"severity": "HIGH"
},
"details": "An issue found in libming v.0.4.8 allows a local attacker to execute arbitrary code via the parseSWF_IMPORTASSETS function in the parser.c file.",
"id": "GHSA-6cf7-f54v-7vjm",
"modified": "2024-04-04T03:55:44Z",
"published": "2023-05-09T18:30:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-31240"
},
{
"type": "WEB",
"url": "https://github.com/libming/libming/issues/218"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-6CQX-88R9-52G7
Vulnerability from github – Published: 2025-07-10 09:32 – Updated: 2025-12-19 18:31In the Linux kernel, the following vulnerability has been resolved:
crypto: sun8i-ce-cipher - fix error handling in sun8i_ce_cipher_prepare()
Fix two DMA cleanup issues on the error path in sun8i_ce_cipher_prepare():
1] If dma_map_sg() fails for areq->dst, the device driver would try to free DMA memory it has not allocated in the first place. To fix this, on the "theend_sgs" error path, call dma unmap only if the corresponding dma map was successful.
2] If the dma_map_single() call for the IV fails, the device driver would try to free an invalid DMA memory address on the "theend_iv" path: ------------[ cut here ]------------ DMA-API: sun8i-ce 1904000.crypto: device driver tries to free an invalid DMA memory address WARNING: CPU: 2 PID: 69 at kernel/dma/debug.c:968 check_unmap+0x123c/0x1b90 Modules linked in: skcipher_example(O+) CPU: 2 UID: 0 PID: 69 Comm: 1904000.crypto- Tainted: G O 6.15.0-rc3+ #24 PREEMPT Tainted: [O]=OOT_MODULE Hardware name: OrangePi Zero2 (DT) pc : check_unmap+0x123c/0x1b90 lr : check_unmap+0x123c/0x1b90 ... Call trace: check_unmap+0x123c/0x1b90 (P) debug_dma_unmap_page+0xac/0xc0 dma_unmap_page_attrs+0x1f4/0x5fc sun8i_ce_cipher_do_one+0x1bd4/0x1f40 crypto_pump_work+0x334/0x6e0 kthread_worker_fn+0x21c/0x438 kthread+0x374/0x664 ret_from_fork+0x10/0x20 ---[ end trace 0000000000000000 ]---
To fix this, check for !dma_mapping_error() before calling dma_unmap_single() on the "theend_iv" path.
{
"affected": [],
"aliases": [
"CVE-2025-38300"
],
"database_specific": {
"cwe_ids": [
"CWE-401"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-07-10T08:15:28Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: sun8i-ce-cipher - fix error handling in sun8i_ce_cipher_prepare()\n\nFix two DMA cleanup issues on the error path in sun8i_ce_cipher_prepare():\n\n1] If dma_map_sg() fails for areq-\u003edst, the device driver would try to free\n DMA memory it has not allocated in the first place. To fix this, on the\n \"theend_sgs\" error path, call dma unmap only if the corresponding dma\n map was successful.\n\n2] If the dma_map_single() call for the IV fails, the device driver would\n try to free an invalid DMA memory address on the \"theend_iv\" path:\n ------------[ cut here ]------------\n DMA-API: sun8i-ce 1904000.crypto: device driver tries to free an invalid DMA memory address\n WARNING: CPU: 2 PID: 69 at kernel/dma/debug.c:968 check_unmap+0x123c/0x1b90\n Modules linked in: skcipher_example(O+)\n CPU: 2 UID: 0 PID: 69 Comm: 1904000.crypto- Tainted: G O 6.15.0-rc3+ #24 PREEMPT\n Tainted: [O]=OOT_MODULE\n Hardware name: OrangePi Zero2 (DT)\n pc : check_unmap+0x123c/0x1b90\n lr : check_unmap+0x123c/0x1b90\n ...\n Call trace:\n check_unmap+0x123c/0x1b90 (P)\n debug_dma_unmap_page+0xac/0xc0\n dma_unmap_page_attrs+0x1f4/0x5fc\n sun8i_ce_cipher_do_one+0x1bd4/0x1f40\n crypto_pump_work+0x334/0x6e0\n kthread_worker_fn+0x21c/0x438\n kthread+0x374/0x664\n ret_from_fork+0x10/0x20\n ---[ end trace 0000000000000000 ]---\n\nTo fix this, check for !dma_mapping_error() before calling\ndma_unmap_single() on the \"theend_iv\" path.",
"id": "GHSA-6cqx-88r9-52g7",
"modified": "2025-12-19T18:31:05Z",
"published": "2025-07-10T09:32:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-38300"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/19d267d9fad00d94ad8477899e38ed7c11f33fb6"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/4051250e5db489f8ad65fc337e2677b9b568ac72"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/a0ac3f85b2e3ef529e852f252a70311f9029d5e6"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/c62b79c1c51303dbcb6edfa4de0ee176f4934c52"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/f31adc3e356f7350d4a4d68c98d3f60f2f6e26b3"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation MIT-41
Strategy: Libraries or Frameworks
- Choose a language or tool that provides automatic memory management, or makes manual memory management less error-prone.
- For example, glibc in Linux provides protection against free of invalid pointers.
- When using Xcode to target OS X or iOS, enable automatic reference counting (ARC) [REF-391].
- To help correctly and consistently manage memory when programming in C++, consider using a smart pointer class such as std::auto_ptr (defined by ISO/IEC ISO/IEC 14882:2003), std::shared_ptr and std::unique_ptr (specified by an upcoming revision of the C++ standard, informally referred to as C++ 1x), or equivalent solutions such as Boost.
Mitigation
Use an abstraction library to abstract away risky APIs. Not a complete solution.
Mitigation
Consider using the Boehm-Demers-Weiser garbage collector (bdwgc), which can help avoid leaks.
No CAPEC attack patterns related to this CWE.