# Race frees in-use object

Unlocked hash, refcount or GC path frees a struct another thread still reads

_Area: Memory corruption and native code. Seen in 12 disclosed reports; 5 confirmed bounties, median $10,000, range $480-$10,000; latest 2026-05-01. Updated 2026-10-23._

## How it works
Two code paths touch the same object without a shared lock or a correct reference count. One path decides the object is dead and frees it; the other still holds a pointer and reads or writes it. The broken assumption is that "only one thread owns this object" or "the refcount protects it." That fails when a lookup matches by a reusable key (fd), when a refcount is skipped for one page/object class, or when a teardown path frees something a concurrent path is mid-use on.

## Where it shows up
- Hash tables with add/del/expire paths taking different locks (per-connection vs global) [E6](https://bugbountylibrary.com/r/blog%3Ablog-doyensec-com-2025-01-07-ksmbd-1-html.md)
- Refcount get/put asymmetry across object classes, e.g. PFNMAP pages skipping get_page but still put_page'd on teardown [E1](https://bugbountylibrary.com/r/p0%3ACVE-2024-44068.md)
- GC or expiry logic racing refcount changes from recvmsg/MSG_PEEK on inflight descriptors [E2](https://bugbountylibrary.com/r/p0%3ACVE-2021-0920.md)
- Kernel code storing a user fd and later matching on that fd to drop a reference [E3](https://bugbountylibrary.com/r/h1%3A3320669.md)
- A pointer to a local stack buffer stored into a shared object that another thread can free [E4](https://bugbountylibrary.com/r/h1%3A2900606.md)
- setsockopt handlers allocating per-option structs with asymmetric locking [E5](https://bugbountylibrary.com/r/h1%3A826026.md)
- "Single object" invariants enforced by VMA flags plus a pointer check that a split VMA defeats [E7](https://bugbountylibrary.com/r/p0%3ACVE-2023-4211.md)
- Signal-based timeouts (alarm/siglongjmp) jumping past locks around shared globals [E8](https://bugbountylibrary.com/r/h1%3A1990421.md)

## How to review
For every free, ask: what guarantees no other thread holds a pointer? The invariant is that an object is freed only after all references are released under the same lock that guards lookup, or that every use holds a counted reference. Check get/put symmetry per class, that fd-keyed lookups cannot alias a reused fd, that stack pointers never escape into shared state, and that signal/GC paths cannot free an object mid-use. Test fd reuse and partial munmap to break single-object assumptions.

## Variants seen
- Skipped refcount on PFNMAP pages, teardown put_page frees mapped pages [E1](https://bugbountylibrary.com/r/p0%3ACVE-2024-44068.md)
- Socket GC vs MSG_PEEK refcount race freeing sk_buff [E2](https://bugbountylibrary.com/r/p0%3ACVE-2021-0920.md)
- Double fdrop via fd-number matching [E3](https://bugbountylibrary.com/r/h1%3A3320669.md)
- Free of another thread's kernel stack pointer [E4](https://bugbountylibrary.com/r/h1%3A2900606.md)
- Unlocked setsockopt option struct freed while in use [E5](https://bugbountylibrary.com/r/h1%3A826026.md)
- Session hash race and session refcount UAF [E6](https://bugbountylibrary.com/r/blog%3Ablog-doyensec-com-2025-01-07-ksmbd-1-html.md)
- VMA split defeats single-tracking-page check [E7](https://bugbountylibrary.com/r/p0%3ACVE-2023-4211.md)
- siglongjmp bypasses mutex on global buffer [E8](https://bugbountylibrary.com/r/h1%3A1990421.md)

## Impact and severity
Led to kernel EoP, arbitrary read/write, and sandbox escape; median bounty $10k. Worse when the freed object holds hijackable pointers (pktinfo, page tables) or when unauthenticated remote paths reach it [E6](https://bugbountylibrary.com/r/blog%3Ablog-doyensec-com-2025-01-07-ksmbd-1-html.md).

## Evidence
- E1: https://bugbountylibrary.com/r/p0%3ACVE-2024-44068.md
- E2: https://bugbountylibrary.com/r/p0%3ACVE-2021-0920.md
- E3: https://bugbountylibrary.com/r/h1%3A3320669.md
- E4: https://bugbountylibrary.com/r/h1%3A2900606.md
- E5: https://bugbountylibrary.com/r/h1%3A826026.md
- E6: https://bugbountylibrary.com/r/blog%3Ablog-doyensec-com-2025-01-07-ksmbd-1-html.md
- E7: https://bugbountylibrary.com/r/p0%3ACVE-2023-4211.md
- E8: https://bugbountylibrary.com/r/h1%3A1990421.md