cve.bz

CWE-662: Improper Synchronization

Filter

The product utilizes multiple threads, processes, components, or systems to allow temporary access to a shared resource that can only be exclusive to one process at a time, but it does not properly synchronize these actions, which might cause simultaneous accesses of this resource by multiple threads or processes.

What the weakness is: CWE-662 at MITRE. All weaknesses

Related attack patterns (CAPEC): 4
  • CAPEC-25 Forced Deadlock Likelihood: Low · Severity: High
  • CAPEC-26 Leveraging Race Conditions Likelihood: High · Severity: High
  • CAPEC-27 Leveraging Race Conditions via Symbolic Links Likelihood: Medium · Severity: High
  • CAPEC-29 Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions Likelihood: High · Severity: High

The attack patterns MITRE's CAPEC relates to CWE-662, as MITRE names them. Credits.

Ask an AI about CWE-662

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-662: Improper Synchronization and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/662.html and https://cve.bz/cve/cwe/662?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 8.2CVE-2026-72057EPSS 0.6%

    In the Linux kernel, the following vulnerability has been resolved: net/sched: act_ct: preserve tc_skb_cb across defragmentation tcf_ct_handle_fragments() calls nf_ct_handle_fragments() without saving and restoring skb->cb. The defrag he…

  2. 7.8CVE-2026-68404EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: use wiphy work for socket owner autodisconnect nl80211_netlink_notify() walks the cfg80211 wireless device list when a NETLINK_GENERIC socket is released…

  3. 8.4CVE-2026-68149EPSS 0.1%

    In the Linux kernel, the following vulnerability has been resolved: fs: preserve ACL_DONT_CACHE state in forget_cached_acl() The ACL_DONT_CACHE state is meant to be a constant state for the inode for filesystems that want to opt out of p…

  4. 7.1CVE-2026-68103EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: reject mapping a reserved doorbell to a new queue When creating an user-queue, the user space provides a doorbell BO handle and an offset within the bo to ob…

  5. 7.8CVE-2026-64556EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: perf/core: Detach event groups during remove_on_exec perf_event_remove_on_exec() removes events by calling perf_event_exit_event(). For top-level events, this removes th…

  6. 7.5CVE-2026-64312EPSS 0.5%

    In the Linux kernel, the following vulnerability has been resolved: crypto: pcrypt - restore callback for non-parallel fallback pcrypt installs pcrypt_aead_done() on the child AEAD request before trying to submit it through padata. If p…

  7. 7.8CVE-2026-64005EPSS 0.1%

    In the Linux kernel, the following vulnerability has been resolved: net/smc: Do not re-initialize smc hashtables INIT_HLIST_HEAD(&smc_v*_hashinfo.ht) are called after smc_nl_init(), proto_register() and sock_register(). This can lead to …

  8. 8.8CVE-2026-63832EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: add wcid publish check in mt76_sta_add Since mt7925_mac_sta_add publishes wcid, add publish check in mt76_sta_add to avoid reinitializing the wcid->poll_list…

  9. 1.3CVE-2026-13489EPSS 0.3%

    A weakness has been identified in 78 xiaozhi-esp32 up to 2.2.6. Affected by this issue is the function ParseMessage of the file main/mcp_server.cc of the component MCP Response Handler. This manipulation causes improper synchronization. Re…

  10. 8.8CVE-2026-53277EPSS 0.1%

    In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation walk_s1() and kvm_walk_nested_s2() expect to be called while holding kvm->srcu to…

  11. 8.2CVE-2026-43466EPSS 0.4%

    In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery In case of a TX error CQE, a recovery flow is triggered, mlx5e_reset_txqsq_cc_pc() resets dma_fifo_cc to 0 but no…

  12. 8.1CVE-2026-43362EPSS 0.3%

    In the Linux kernel, the following vulnerability has been resolved: smb: client: fix in-place encryption corruption in SMB2_write() SMB2_write() places write payload in iov[1..n] as part of rq_iov. smb3_init_transform_rq() pointer-shares…

  13. 7.8CVE-2026-31479EPSS 0.1%

    In the Linux kernel, the following vulnerability has been resolved: drm/xe: always keep track of remap prev/next During 3D workload, user is reporting hitting: [ 413.361679] WARNING: drivers/gpu/drm/xe/xe_vm.c:1217 at vm_bind_ioctl_ops…

  14. 5.9CVE-2026-39865EPSS 0.7%

    Axios is a promise based HTTP client for the browser and Node.js. Starting in version 1.13.0 and prior to 1.13.2, Axios HTTP/2 session cleanup logic contains a state corruption bug that allows a malicious server to crash the client process…

  15. 5.5CVE-2026-23437EPSS 0.1%

    In the Linux kernel, the following vulnerability has been resolved: net: shaper: protect late read accesses to the hierarchy We look up a netdev during prep of Netlink ops (pre- callbacks) and take a ref to it. Then later in the body of …

  16. 7.5CVE-2026-28789EPSS 0.5%

    OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.10.3, an unauthenticated denial-of-service vulnerability exists in OliveTin’s OAuth2 login flow. Concurrent requests to /oauth/login can trigger…

  17. 9.8CVE-2025-68775EPSS 0.5%

    In the Linux kernel, the following vulnerability has been resolved: net/handshake: duplicate handshake cancellations leak socket When a handshake request is cancelled it is removed from the handshake_net->hn_requests list, but it is stil…

  18. 1.8CVE-2025-22853EPSS 0.2%

    Improper synchronization in the firmware for some Intel(R) TDX may allow a privileged user to potentially enable escalation of privilege via local access.

  19. 3.7CVE-2024-58131EPSS 0.3%

    FISCO BCOS 3.11.0 has an issue with synchronization of the transaction pool that can, for example, be observed when a malicious node (that has modified the codebase to allow a large min_seal_time value) joins a blockchain network.

  20. 2.3CVE-2025-27104EPSS 0.4%

    vyper is a Pythonic Smart Contract Language for the EVM. Multiple evaluation of a single expression is possible in the iterator target of a for loop. While the iterator expression cannot produce multiple writes, it can consume side effects…

  21. 7.5CVE-2024-7409EPSS 1.0%

    A flaw was found in the QEMU NBD Server. This vulnerability allows a denial of service (DoS) attack via improper synchronization during socket closure when a client keeps a socket open as the server is taken offline.

  22. 9.1CVE-2024-32644EPSS 0.9%

    Evmos is a scalable, high-throughput Proof-of-Stake EVM blockchain that is fully compatible and interoperable with Ethereum. Prior to 17.0.0, there is a way to mint arbitrary tokens due to the possibility to have two different states not i…

  23. 7.1CVE-2024-30387EPSS 0.2%

    A Missing Synchronization vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on ACX5448 and ACX710 allows an unauthenticated, adjacent attacker to cause a Denial-of-Service (DoS). If an interface flaps while …

  24. 5.5CVE-2021-46939EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: tracing: Restructure trace_clock_global() to never block It was reported that a fix to the ring buffer recursion detection would cause a hung machine when performing sus…

  25. 6.1CVE-2023-45084EPSS 0.2%

    An issue exists in SoftIron HyperCloud where drive caddy removal and reinsertion without a reboot may erroneously cause the system to recognize the caddy as new media and wipe all data on the drives due to a missing synchronization flaw, w…

  26. 7.0CVE-2023-5088EPSS 0.3%

    A bug in QEMU could cause a guest I/O operation otherwise addressed to an arbitrary disk offset to be targeted to offset 0 instead (potentially overwriting the VM's boot code). This could be used, for example, by L2 guests with a virtual d…

  27. 5.3CVE-2023-2801EPSS 0.7%

    Grafana is an open-source platform for monitoring and observability. Using public dashboards users can query multiple distinct data sources using mixed queries. However such query has a possibility of crashing a Grafana instance. The on…

  28. 6.4CVE-2023-20625EPSS 0.08%

    In adsp, there is a possible double free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07628532; Issue ID: …

  29. 6.4CVE-2023-20611EPSS 0.09%

    In gpu, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07588678; Issue ID…

  30. 6.4CVE-2023-20610EPSS 0.09%

    In display drm, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS0736346…

  31. 6.4CVE-2023-20607EPSS 0.09%

    In ccu, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07512839; Issue…

  32. 6.4CVE-2022-32643EPSS 0.2%

    In ccd, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07341261; Issue ID…

  33. 6.4CVE-2022-32642EPSS 0.1%

    In ccd, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07326547; Issue…

  34. 8.7CVE-2022-23005EPSS 0.8%

    Western Digital has identified a weakness in the UFS standard that could result in a security vulnerability. This vulnerability may exist in some systems where the Host boot ROM code implements the UFS Boot feature to boot from UFS complia…

  35. 6.4CVE-2022-32648EPSS 0.1%

    In disp, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06535964; Issue I…

  36. 4.1CVE-2022-32645EPSS 0.10%

    In vow, there is a possible information disclosure due to a race condition. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07494477; I…

  37. 6.4CVE-2022-32644EPSS 0.1%

    In vow, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07494473; Issue ID…

  38. 6.4CVE-2022-32610EPSS 0.1%

    In vcu, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07203476; Issue ID…

  39. 6.4CVE-2022-32609EPSS 0.1%

    In vcu, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07203410; Issue ID…

  40. 7.8CVE-2022-3565EPSS 0.4%

    A vulnerability, which was classified as critical, has been found in Linux Kernel. Affected by this issue is the function del_timer of the file drivers/isdn/mISDN/l1oip_core.c of the component Bluetooth. The manipulation leads to use after…

  41. 7.8CVE-2022-2962EPSS 0.4%

    A DMA reentrancy issue was found in the Tulip device emulation in QEMU. When Tulip reads or writes to the rx/tx descriptor or copies the rx/tx frame, it doesn't check whether the destination address is its own MMIO address. This can cause …

  42. 8.1CVE-2022-1931EPSS 1.7%

    Incorrect Synchronization in GitHub repository polonel/trudesk prior to 1.2.3.

  43. 6.5CVE-2022-25210EPSS 0.8%

    Jenkins Convertigo Mobile Platform Plugin 1.1 and earlier uses static fields to store job configuration information, allowing attackers with Item/Configure permission to capture passwords of the jobs that will be configured.

  44. 6.5CVE-2021-36305EPSS 0.8%

    Dell PowerScale OneFS contains an Unsynchronized Access to Shared Data in a Multithreaded Context in SMB CA handling. An authenticated user of SMB on a cluster with CA could potentially exploit this vulnerability, leading to a denial of se…

  45. 5.5CVE-2021-41213EPSS 0.2%

    TensorFlow is an open source platform for machine learning. In affected versions the code behind `tf.function` API can be made to deadlock when two `tf.function` decorated Python functions are mutually recursive. This occurs due to using a…

  46. 5.3CVE-2021-30904EPSS 0.8%

    A sync issue was addressed with improved state validation. This issue is fixed in macOS Monterey 12.0.1. A user's messages may continue to sync after the user has signed out of iMessage.

  47. 7.5CVE-2021-20592EPSS 1.5%

    Missing synchronization vulnerability in GOT2000 series GT27 model communication driver versions 01.19.000 through 01.39.010, GT25 model communication driver versions 01.19.000 through 01.39.010 and GT23 model communication driver versions…

  48. 7.0CVE-2020-25668EPSS 1.0%

    A flaw was found in Linux Kernel because access to the global variable fg_console is not properly synchronized leading to a use after free in con_font_op.

  49. 5.9CVE-2018-25008EPSS 1.1%

    In the standard library in Rust before 1.29.0, there is weak synchronization in the Arc::get_mut method. This synchronization issue can be lead to memory safety issues through race conditions.

  50. 5.3CVE-2021-25376EPSS 0.8%

    An improper synchronization logic in Samsung Email prior to version 6.1.41.0 can leak messages in certain mailbox in plain text when STARTTLS negotiation is failed.