CWE-666: Operation on Resource in Wrong Phase of Lifetime
Filter
The product performs an operation on a resource at the wrong phase of the resource's lifecycle, which can lead to unexpected behaviors.
What the weakness is: CWE-666 at MITRE
Ask an AI about CWE-666
Show the prompt
Explain CWE-666: Operation on Resource in Wrong Phase of Lifetime and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/666.html and https://cve.bz/cve/cwe/666?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.
- 5.7CVE-2026-85036
The Bluetooth Classic AVDTP layer defers releasing a session's stream endpoints: bt_avdtp_l2cap_disconnected() in subsys/bluetooth/host/classic/avdtp.c ends with k_work_submit(&session->_release_work), placing the embedded struct k_work on…
- 4.6CVE-2026-16148EPSS 0.2%
The ITE it82xx2 USB device-controller driver initialized its bus-suspend detection work with k_work_init_delayable(&priv->suspended_work, suspended_handler) inside it82xx2_enable() (the driver's .enable op) in drivers/usb/udc/udc_it82xx2.c…
- 5.4CVE-2026-15460EPSS 0.2%
The Bluetooth Classic (BR/EDR) L2CAP receive handler bt_l2cap_br_recv() in subsys/bluetooth/host/classic/l2cap_br.c dispatched inbound data PDUs based only on the destination channel ID, without checking that the target channel had reached…
- 6.5CVE-2026-68930EPSS 0.4%
Russh is a Rust SSH client & server library. Prior to 0.62.5, russh dispatches channel-scoped Handler callbacks for recipient channel IDs that were never opened or confirmed in russh/src/server/encrypted.rs, server_read_authenticated, and …
- 9.8CVE-2026-64162EPSS 0.4%
In the Linux kernel, the following vulnerability has been resolved: idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() In idpf_ptp_init(), read_dev_clk_lock is initialized after ptp_schedule_worker() had already been called (an…