CWE-667— Improper Locking

The product does not properly acquire or release a lock on a resource, leading to unexpected resource state changes and behaviors.— MITRE CWE catalog

745 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-667page 3 of 15

CVE-2018-1000127HIGHCVSS 7.5EG 7.5
2018-03-13
memcached version prior to 1.4.37 contains an Integer Overflow vulnerability in items.c:item_free() that can result in data corruption and deadlocks due to items existing in hash table being reused from free list. This attack appear to be …
CVE-2009-4272HIGHCVSS 7.5EG 7.5
2010-01-27
A certain Red Hat patch for net/ipv4/route.c in the Linux kernel 2.6.18 on Red Hat Enterprise Linux (RHEL) 5 allows remote attackers to cause a denial of service (deadlock) via crafted packets that force collisions in the IPv4 routing hash…
CVE-2009-2699HIGHCVSS 7.5EG 7.5
2009-10-13
The Solaris pollset feature in the Event Port backend in poll/unix/port.c in the Apache Portable Runtime (APR) library before 1.3.9, as used in the Apache HTTP Server before 2.2.14 and other products, does not properly handle errors, which…
CVE-2006-5158HIGHCVSS 7.5EG 7.5
2006-10-05
The nlmclnt_mark_reclaim in clntlock.c in NFS lockd in Linux kernel before 2.6.16 allows remote attackers to cause a denial of service (process crash) and deny access to NFS exports via unspecified vectors that trigger a kernel oops (null …
CVE-2006-2275HIGHCVSS 7.5EG 7.5
2006-05-09
Linux SCTP (lksctp) before 2.6.17 allows remote attackers to cause a denial of service (deadlock) via a large number of small messages to a receiver application that cannot process the messages quickly enough, which leads to "spillover of …
CVE-2004-0174HIGHCVSS 7.5EG 7.5
2004-05-04
Apache 1.4.x before 1.3.30, and 2.0.x before 2.0.49, when using multiple listening sockets on certain platforms, allows remote attackers to cause a denial of service (blocked new connections) via a "short-lived connection on a rarely-acces…
CVE-2002-1850HIGHCVSS 7.5EG 7.5
2002-12-31
mod_cgi in Apache 2.0.39 and 2.0.40 allows local users and possibly remote attackers to cause a denial of service (hang and memory consumption) by causing a CGI script to send a large amount of data to stderr, which results in a read/write…
CVE-2023-21189HIGHCVSS 7.3EG 7.3
2023-06-28
In startLockTaskMode of LockTaskController.java, there is a possible bypass of lock task mode due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interacti…
CVE-2025-10151HIGHCVSS 7.2EG 7.2
2025-10-28
Improper locking vulnerability in Softing Industrial Automation GmbH gateways allows infected memory and/or resource leak exposure.This issue affects smartLink HW-PN: from 1.02 through 1.03 smartLink HW-DP: 1.31
CVE-2019-6321HIGHCVSS 7.2EG 7.2
2019-05-29
HP has identified a security vulnerability with some versions of Workstation BIOS (UEFI Firmware) where the runtime BIOS code could be tampered with if the TPM is disabled. This vulnerability relates to Workstations whose TPM is disabled b…
CVE-2026-31486HIGHCVSS 7.1EG 7.1
2026-04-22
In the Linux kernel, the following vulnerability has been resolved: hwmon: (pmbus/core) Protect regulator operations with mutex The regulator operations pmbus_regulator_get_voltage(), pmbus_regulator_set_voltage(), and pmbus_regulator_li…
CVE-2022-48760HIGHCVSS 7.1EG 7.1
2024-06-20
In the Linux kernel, the following vulnerability has been resolved: USB: core: Fix hang in usb_kill_urb by adding memory barriers The syzbot fuzzer has identified a bug in which processes hang waiting for usb_kill_urb() to return. It tu…
CVE-2023-44297HIGHCVSS 6.8EG 7.1
2023-12-05
Dell PowerEdge platforms 16G Intel E5 BIOS and Dell Precision BIOS, version 1.4.4, contain active debug code security vulnerability. An unauthenticated physical attacker could potentially exploit this vulnerability, leading to information…
CVE-2026-46299HIGHCVSS 7.0EG 7.0
2026-06-08
In the Linux kernel, the following vulnerability has been resolved: hfsplus: fix held lock freed on hfsplus_fill_super() hfsplus_fill_super() calls hfs_find_init() to initialize a search structure, which acquires tree->tree_lock. If the …
CVE-2025-27732HIGHCVSS 7.0EG 7.0
2025-04-08
Sensitive data storage in improperly locked memory in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally.
CVE-2022-20422HIGHCVSS 7.0EG 7.0
2022-10-11
In emulation_proc_handler of armv8_deprecated.c, there is a possible way to corrupt memory due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not ne…
CVE-2022-3028HIGHCVSS 7.0EG 7.0
2022-08-31
A race condition was found in the Linux kernel's IP framework for transforming packets (XFRM subsystem) when multiple calls to xfrm_probe_algs occurred simultaneously. This flaw could allow a local attacker to potentially trigger an out-of…
CVE-2022-2959HIGHCVSS 7.0EG 7.0
2022-08-25
A race condition was found in the Linux kernel's watch queue due to a missing lock in pipe_resize_ring(). The specific flaw exists within the handling of pipe buffers. The issue results from the lack of proper locking when performing opera…
CVE-2021-26708HIGHCVSS 7.0EG 7.0
2021-02-05
A local privilege escalation was discovered in the Linux kernel before 5.10.13. Multiple race conditions in the AF_VSOCK implementation are caused by wrong locking in net/vmw_vsock/af_vsock.c. The race conditions were implicitly introduced…
CVE-2019-14898HIGHCVSS 7.0EG 7.0
2020-05-08
The fix for CVE-2019-11599, affecting the Linux kernel before 5.0.10 was not complete. A local user could use this flaw to obtain sensitive information, cause a denial of service, or possibly have other unspecified impacts by triggering a …
CVE-2019-11599HIGHCVSS 7.0EG 7.0
2019-04-29
The coredump implementation in the Linux kernel before 5.0.10 does not use locking or other mechanisms to prevent vma layout or vma flags changes while it runs, which allows local users to obtain sensitive information, cause a denial of se…
CVE-2025-48618MEDIUMCVSS 6.8EG 6.8
2025-12-08
In processLaunchBrowser of CommandParamsFactory.java, there is a possible browser interaction from the lockscreen due to improper locking. This could lead to physical escalation of privilege with no additional execution privileges needed. …
CVE-2023-44298MEDIUMCVSS 6.8EG 6.8
2023-12-05
Dell PowerEdge platforms 16G Intel E5 BIOS and Dell Precision BIOS, version 1.4.4, contain active debug code security vulnerability. An unauthenticated physical attacker could potentially exploit this vulnerability, leading to information…
CVE-2020-9946MEDIUMCVSS 6.8EG 6.8
2020-10-16
This issue was addressed with improved checks. This issue is fixed in iOS 14.0 and iPadOS 14.0, watchOS 7.0. The screen lock may not engage after the specified time period.
CVE-2019-17343MEDIUMCVSS 6.8EG 6.8
2019-10-08
An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service or gain privileges by leveraging incorrect use of the HVM physmap concept for PV domains.
CVE-2019-6322MEDIUMCVSS 6.8EG 6.8
2019-05-29
HP has identified a security vulnerability with some versions of Workstation BIOS (UEFI Firmware) where the runtime BIOS code could be tampered with if the TPM is disabled. This vulnerability relates to Workstations whose TPM is enabled by…
CVE-2018-0381MEDIUMCVSS 6.8EG 6.8
2018-10-17
A vulnerability in the Cisco Aironet Series Access Points (APs) software could allow an authenticated, adjacent attacker to cause an affected device to reload unexpectedly, resulting in a denial of service (DoS) condition. The vulnerabilit…
CVE-2018-15390MEDIUMCVSS 6.8EG 6.8
2018-10-05
A vulnerability in the FTP inspection engine of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition. The vuln…
CVE-2023-33951MEDIUMCVSS 6.7EG 6.7
2023-07-24
A race condition vulnerability was found in the vmwgfx driver in the Linux kernel. The flaw exists within the handling of GEM objects. The issue results from improper locking when performing operations on an object. This flaw allows a loca…
CVE-2023-21400MEDIUMCVSS 6.7EG 6.7
2023-07-13
In multiple functions of io_uring.c, there is a possible kernel memory corruption due to improper locking. This could lead to local escalation of privilege in the kernel with System execution privileges needed. User interaction is not nee…
CVE-2023-20746MEDIUMCVSS 6.7EG 6.7
2023-06-06
In vcu, there is a possible out of bounds write due to improper locking. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07519142; Iss…
CVE-2023-20745MEDIUMCVSS 6.7EG 6.7
2023-06-06
In vcu, there is a possible out of bounds write due to improper locking. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07519142; Iss…
CVE-2023-20743MEDIUMCVSS 6.7EG 6.7
2023-06-06
In vcu, there is a possible out of bounds write due to improper locking. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07519142; Iss…
CVE-2023-20737MEDIUMCVSS 6.7EG 6.7
2023-06-06
In vcu, there is a possible use after free due to improper locking. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07645149; Issue ID…
CVE-2023-20733MEDIUMCVSS 6.7EG 6.7
2023-06-06
In vcu, there is a possible use after free due to improper locking. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07645149; Issue ID…
CVE-2023-20619MEDIUMCVSS 6.7EG 6.7
2023-02-06
In vcu, there is a possible memory corruption due to improper locking. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07519159; Issue…
CVE-2023-20618MEDIUMCVSS 6.7EG 6.7
2023-02-06
In vcu, there is a possible memory corruption due to improper locking. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07519184; Issue…
CVE-2022-26473MEDIUMCVSS 6.7EG 6.7
2022-10-07
In vdec fmt, there is a possible use after free due to improper locking. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07342197; Iss…
CVE-2022-26452MEDIUMCVSS 6.7EG 6.7
2022-10-07
In isp, there is a possible use after free due to improper locking. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07262305; Issue ID…
CVE-2022-26451MEDIUMCVSS 6.7EG 6.7
2022-09-06
In ged, there is a possible use after free due to improper locking. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07202966; Issue ID…
CVE-2022-20376MEDIUMCVSS 6.7EG 6.7
2022-08-11
In trusty_log_seq_start of trusty-log.c, there is a possible use after free due to improper locking. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.…
CVE-2022-21775MEDIUMCVSS 6.7EG 6.7
2022-07-06
In sched driver, there is a possible use after free due to improper locking. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06479032;…
CVE-2022-20153MEDIUMCVSS 6.7EG 6.7
2022-06-15
In rcu_cblist_dequeue of rcu_segcblist.c, there is a possible use-after-free due to improper locking. This could lead to local escalation of privilege in the kernel with System execution privileges needed. User interaction is not needed fo…
CVE-2022-20016MEDIUMCVSS 6.7EG 6.7
2022-01-04
In vow driver, there is a possible memory corruption due to improper locking. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS05862986…
CVE-2021-39656MEDIUMCVSS 6.7EG 6.7
2021-12-15
In __configfs_open_file of file.c, there is a possible use-after-free due to improper locking. This could lead to local escalation of privilege in the kernel with System execution privileges needed. User interaction is not needed for explo…
CVE-2021-39649MEDIUMCVSS 6.7EG 6.7
2021-12-15
In regmap_exit of regmap.c, there is a possible use-after-free due to improper locking. This could lead to local escalation of privilege in the kernel with System execution privileges needed. User interaction is not needed for exploitation…
CVE-2021-0625MEDIUMCVSS 6.7EG 6.7
2021-10-25
In ccu, there is a possible memory corruption due to improper locking. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS05594996; Issue…
CVE-2020-27066MEDIUMCVSS 6.7EG 6.7
2020-12-15
In xfrm6_tunnel_free_spi of net/ipv6/xfrm6_tunnel.c, there is a possible use after free due to improper locking. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for e…
CVE-2019-9447MEDIUMCVSS 6.7EG 6.7
2019-09-06
In the Android kernel in the FingerTipS touchscreen driver there is a possible use-after-free due to improper locking. This could lead to a local escalation of privilege with System execution privileges needed. User interaction is not need…
CVE-2019-9275MEDIUMCVSS 6.7EG 6.7
2019-09-06
In the Android kernel in the mnh driver there is a use after free due to improper locking. This could lead to escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.

Map vulnerabilities like CWE-667 to your infrastructure

EchelonGraph correlates every CVE — across CWE-667 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →