Use-after-free in the Linux kernel IPv4 networking stack allows potential kernel memory disclosure or corruption when destination (dst) entries are accessed without proper RCU protection during ICMP rate-limiting, IP fragment reassembly, and multicast forwarding. The fix converts icmpv4_xrlim_allow(), ip_defrag(), the ipmr multicast transmit paths, and ipv4_neigh_lookup() to the lockdep-enabled dst_dev_rcu() accessor. No public exploit identified at time of analysis, and EPSS probability is low (0.17%, 7th percentile), consistent with a hard-to-win kernel race rather than a readily weaponized flaw.
Use-after-free vulnerability in Mozilla Firefox 142 and 143 enables compromised renderer processes to trigger memory corruption in the GPU or browser process via malicious WebGPU IPC calls, potentially achieving sandbox escape. Affecting Firefox versions 142.0 through 144.0.1, this CWE-416 flaw carries CVSS 9.8 despite low real-world exploitation probability (EPSS 0.06%, 18th percentile). No public exploit identified at time of analysis. Patched in Firefox 144.0.2 released January 2025.