CVE-2021-47598

CVE-2021-47598 affects the Linux kernel (net/sched/sch_cake) where calling cake_destroy() from cake_init() during qdisc creation could trigger use-after-free in the cake/qdisc destroy path. The issue manifests when a qdisc invokes its own destroy() method during initialization, conflicting with t...

CVE-2022-34495

CVE-2022-34495: In the Linux kernel, rpmsg_probe in drivers/rpmsg/virtio_rpmsg_bus.c before 5.18.4 is reported to contain a double free. Affected product/version examples include upstream Linux kernels updated to 5.18.4 or later. The connected sources (e.g., Astra Linux security bulletin and vend...

CVE-2022-48918

CVE-2022-48918 — Linux kernel iwlwifi/mvm debugfs_dir null-pointer issue . When debugfs=off is passed, the iwiwifi mvm module used an unchecked debugfs_dir pointer, causing a kernel NULL pointer dereference (BUG) as shown in the provided trace (iwl_mvm_dbgfs_register). The issue is resolved by ad...

CVE-2022-48956

The CVE-2022-48956 issue is a Linux kernel use-after-free vulnerability in IPv6 handling, specifically in ip6_fragment() with a problematic assumption about rcu_read_lock() ownership. The flaw enables a use-after-free in the UDP path (ip6_dst_idev and ip6_fragment) as shown in the syzbot KASAN re...

CVE-2022-49298

CVE-2022-49298 : Linux kernel staging rtl8712 driver fix for uninitialized mac[6] in r871xu_drv_init() after tmpU1b from r8712_read8(padapter, EE_9346CR) == 0. KMSAN reported uninit-value in that function and call chain (usb_intf.c:541; usb_probe_interface; device probing). Concrete details are p...

CVE-2022-49302

CVE-2022-49302 affects the Linux kernel USB host isp116x driver. The vulnerability arises when code fails to check the return value of platform_get_resource(), which can lead to a null pointer dereference if the call returns NULL. The connected documents confirm the issue and state that the fix i...

CVE-2022-49351

CVE-2022-49351 is tied to the Linux kernel fix in net: altera: Fix refcount leak in altera_tse_mdio_create. The issue arises in for_each_child_of_node() iterations where the previous node’s reference count is decremented and, on breaking out of the loop, of_node_put() was not called, leading to a...

CVE-2023-52629

CVE-2023-52629 – Linux kernel use-after-free fixed Root cause: in switch_drv_remove(), the worker (flush_work) could be rescheduled by switch_timer, causing a use-after-free when the code frees psw after timer or worker cleanup. Consequence: a potentially exploitable use-after-free condition with...

CVE-2023-52933

CVE-2023-52933 affects the Linux kernel Squashfs xattr_ids handling. Two overflow flaws were exposed by a corrupted filesystem: on 64‑bit systems, sign extension of xattr_ids when multiplied by sizeof(struct squashfs_xattr_id) can overflow and yield an incorrect len; on 32‑bit systems, the unsign...

CVE-2024-26694

CVE-2024-26694 affects the Linux kernel wifi iwlwifi driver. The vulnerability arises from improper handling of TLV PC register data: the data storage in drv->fw area is freed without clearing the pointer, risking a double-free if a subsequent free occurs (e.g., when a file load fails after pa...

CVE-2024-27400

CVE-2024-27400 affects the Linux kernel drm/amdgpu subsystem. The issue stems from the call order in amdgpu_ttm_move() which caused the old location to become unavailable after a move, affecting DMA-buf and VM move notifications. The fix prioritizes notifying the move before performing the actual...

CVE-2024-35875

CVE-2024-35875 concerns the Linux kernel’s x86/coco RNG seeding feature. The affected area requires seeding the RNG with 256 bits of RDRAND data at boot for CoCo systems, because the CoCo threat model assumes an untrusted host and limited entropy sources. If RDRAND is broken or unavailable, the i...

CVE-2024-35901

CVE-2024-35901 : In the Linux kernel, the mana driver enforced the RX DMA data size to be a multiple of 64, which could cause skb_over_panic on packets slightly larger than MTU+14 (e.g., 1536). The fix removes this alignment requirement; oversized packets are now marked CQE_RX_TRUNCATED by the NI...

CVE-2024-35955

CVE-2024-35955 : Linux kernel vulnerability in kprobe registration that could cause a use-after-free if module unload changes MODULE_STATE from LIVE/GOING to UNFORMED between address checks. The fix switches to using only __module_text_address() and performs try_module_get(module) while MODULE_ST...

CVE-2024-35997

CVE-2024-35997 : In the Linux kernel, the HID i2c-hid driver had I2C_HID_READ_PENDING removed to prevent a lock-up. The flag was used to serialize I2C operations, but I2C core locking is already in place; if the flag is set in i2c_hid_xfer() and an interrupt occurs, i2c_hid_irq could spin in a lo...

CVE-2024-42092

CVE-2024-42092 — Linux kernel GPIO (DaVinci) vulnerability Affected: Linux kernel (gpio: davinci) where pdata->gpio_unbanked is read from the Device Tree. If DT is broken, this value may be invalid and could cause out-of-bounds access to chips->irqs in davinci_gpio_probe(). Root cause: lack...

CVE-2024-44998

CVE-2024-44998 (Linux kernel) is confirmed in multiple sources. Affects the Linux kernel’s ATM stack (idt77252) where a use-after-free could occur in dequeue_rx after skb is released post vcc->push. Connected advisories note the issue across several distributions and provide concrete fixes: De...

CVE-2024-45019

CVE-2024-45019 affects the Linux kernel net/mlx5e component. The vulnerability stems from incorrect locking during the tx_timeout reporter: mlx5e_safe_reopen_channels() requires the state lock, but a prior Fixes change removed it to fix another issue. The referenced patch restores the required st...

CVE-2024-46813

CVE-2024-46813 affects the Linux kernel drm/amd/display code. The fix guards against out-of-bounds access by validating link_index before dereferencing dc->links[], where dc->links[] has a max size of MAX_LINKS; the issue could cause 3 overrun conditions and a resource leak, resolved by the...

CVE-2024-46815

CVE-2024-46815 affects the Linux kernel's DRM/AMD display code. The issue arises when accessing reader_wm_sets[] without validating num_valid_sets, which could yield a negative index and an OVERRUN. The description and connected advisories consistently state the fix was to check num_valid_sets be...

CVE-2024-49890

CVE-2024-49890 : Linux kernel fix for a NULL dereference in drm/amd/pm by ensuring fw_info is not NULL before use. The issue manifested as a null dereference warning reported by Coverity; the patch prevents dereferencing a NULL fw_info and thus mitigates the vulnerability as described in the entr...

CVE-2024-49908

CVE-2024-49908: In the Linux kernel, the AMDGPU display driver (amdgpu_dm) had a missing null check for theafb in amdgpu_dm_update_cursor, risking a null pointer dereference. The fix adds a null check and moves the check to the point of use (line where afb is accessed). Affects drm/amd/display co...

CVE-2024-49988

The CVE-2024-49988 issue concerns the ksmbd kernel SMB server: during an oplock break, opinfo->conn could be used after ksmbd_conn is freed in multichannel scenarios. The fix adds a reference count to ksmbd_conn to ensure it is not freed while still in use. This is a Linux kernel-level vulnera...

CVE-2024-50030

CVE-2024-50030 refers to a Linux kernel vulnerability in drm/xe/ct where a use-after-free (UAF) could occur due to fence/timeout interactions. The fix serializes with the completion side by grabbing ct->lock after the wait to ensure correct ordering of dependent loads/stores and to prevent UAF...

CVE-2024-56710

CVE-2024-56710 is a Linux kernel vulnerability involving a memory leak in the ceph Direct I/O path. The bvecs array allocated in iter_get_bvecs_alloc() can leak and leave pages pinned if ceph_alloc_sparse_ext_map() fails. The fix moves sparse_ext allocation earlier (and applies a similar adjustme...

CVE-2024-56719

The CVE-2024-56719 issue concerns the Linux kernel’s net/stmmac driver (stmmac_tso_xmit) where TX_SKB data was assigned to tx_skbuff_dma[] too late, causing a DMA cookie mismatch for dma_unmap_single() when priv->dma_cap.addr64 > 32. This could trigger Tx DMA map failures (DTM: device warns...

CVE-2024-56766

The CVE-2024-56766 issue affects the Linux kernel’s MTD/NAND path (mtd: rawnand) with a double-free in atmel_pmecc_create_user(). The root cause is allocating the user object with kzalloc() and then freeing it with kfree() after converting the allocation to devm_kzalloc(), leading to a use-after-...

CVE-2024-57935

The CVE-ID describes a Linux kernel flaw in RDMA/hns: when destroying a QP, an invalid dip_ctx pointer could be accessed if the QP could not be modified to RTR, due to the dip_ctx not being attached. This is a local-attack surface with potential kernel access to cause a denial of service or crash...

CVE-2025-21705

CVE-2025-21705 affects the Linux kernel MPTCP implementation (mptcp: handle fastopen disconnect correctly). Root cause: internal disconnect() during FASTOPEN errors was not properly accounted, risking data stream corruption. Fix: increase the socket disconnect counter so other threads waiting on ...

CVE-2025-21712

In the Linux kernel, the md/md-bitmap component had a race where bitmap_get_stats() could be called while the bitmap storage was destroyed or not fully initialized, risking a general protection fault. The root cause was dereferencing bitmap->storage outside a synchronized lifetime of the bitma...

CVE-2025-21748

CVE-2025-21748 – Linux kernel ksmbd integer overflow (32‑bit) Affected component: ksmbd in the Linux kernel. Description from sources: on 32‑bit systems, additions in ipc_msg_alloc() may overflow, risking memory corruption. A bounds check was introduced using KSMBD_IPC_MAX_PAYLOAD to prevent over...

CVE-2025-21868

CVE-2025-21868 affects the Linux kernel: the issue arises in net/core related to small head cache usage when MAX_SKB_FRAGS is large (example build with MAX_SKB_FRAGS=45). The splat trace points to netif_napi_add_weight_locked and related paths; the advisory notes that the root cause is independen...

CVE-2025-21889

Technical details for CVE-2025-21889 are not publicly provided in the supplied documents. No affected products, root cause, or patch information are confirmed here. Monitor vendor advisories for updates.

CVE-2025-22033

CVE-2025-22033: Linux kernel arm64 fix for a NULL pointer dereference in alignment handling. The issue occurs when do_alignment_t32_to_handler() fixes only specific instructions and returns NULL for others (e.g., LDREX); callers would proceed with regular alignment fault handling (SIGBUS). Withou...

CVE-2025-22093

Summary (CVE-2025-22093) The Linux kernel DRM for AMD displays had a NULL pointer dereference risk when DMUB is unsupported on the ASIC. Specifically, ctx->dmub_srv could be NULL (tested in dm_dmub_sw_init) but was dereferenced in dmub_hw_lock_mgr_cmd if should_use_dmub_lock returned true. The...

CVE-2025-37770

CVE-2025-37770 affects the Linux kernel (drm/amd/pm): if a user sets a speed value greater than UINT_MAX/8, a division by zero is possible. The issue is exploitable locally with low privileges and no user interaction required. The vulnerability was identified by the Linux Verification Center (SVA...

CVE-2025-37864

CVE-2025-37864 relates to the Linux kernel DSA subsystem: a cleanup path for FDB, MDB and VLAN entries on unbind was added to fix a scenario where bridge bypass operations could leave stale entries and trigger a leak/warn on unbind. The vulnerability stems from the assumption that higher layers b...

CVE-2025-37893

LoongArch LoongArch: BPF vulnerability fixed in arch/loongarch/net/bpf_jit.c: build_prologue() had an off-by-one error in JIT epilogue generation when mixing bpf2bpf and tailcalls. The first pass sets flags, the second emits N+1 instructions instead of N, causing epilogue_offset to be off and pot...

CVE-2025-37911

The CVE-2025-37911 vulnerability affects the bnxt_en driver in the Linux kernel. It arises when ethtool -w retrieves a FW core dump: the DMA’d segment list length reported by the FW can exceed the allocated info->dest_buf, causing an out-of-bounds copy and memory corruption. Root cause is an u...

CVE-2025-37924

CVE-2025-37924 : Linux kernel ksmbd use-after-free in Kerberos authentication. A race could occur where a thread uses sess->user after it has been freed by ksmbd_free_user, prior to sess->user being set to NULL. The issue is fixed by setting sess->user = NULL to avoid dangling pointer. M...

CVE-2025-38499

The CVE concerns the Linux kernel and the clone_private_mnt() path. The root cause is a missing CAP_SYS_ADMIN check in the correct user namespace during mount handling, which could allow exposure of something hidden by a mount that cannot be undone. The issue is tied to how CAP_SYS_ADMIN is check...

CVE-2026-53215

CVE-2026-53215 affects the Linux kernel mvpp2 driver: the RX path could return a descriptor buffer to the hardware Buffer Manager after it had been handed to XDP or an skb, allowing DMA into memory no longer owned by the RX ring. Root cause is improper handling of RX buffers in mvpp2_rx_refill() ...

CVE-2009-1072

CVE-2009-1072 affects the Linux kernel prior to 2.6.28.9. nfsd in the kernel does not drop the CAP_MKNOD capability before handling a user request in a thread, enabling local users on an exported filesystem using root_squash to create device nodes. MiracleLinux 3 lists this as fixed in kernel-2.6...

CVE-2010-3296

CVE-2010-3296 affects the Linux kernel driver cxgb3 (cxgb_extension_ioctl in drivers/net/cxgb3/cxgb3_main.c). The advisory states that the code path in kernels up to 2.6.36-rc5 does not properly initialize a structure member, allowing a local user to potentially read sensitive data from kernel st...

CVE-2010-3880

CVE-2010-3880 affects the Linux kernel (net/ipv4/inet_diag.c) prior to 2.6.37-rc2. The issue is improper auditing of INET_DIAG bytecode, enabling a local user to trigger a kernel infinite loop and cause a denial of service via crafted INET_DIAG_REQ_BYTECODE instructions in a netlink message conta...

CVE-2010-4075

The CVE-2010-4075 entry affects the Linux kernel module code: uart_get_count (drivers/serial/serial_core.c) in versions prior to 2.6.37-rc1. The vulnerability arises from not properly initializing a certain structure member, enabling local users to read potentially sensitive information from kern...

CVE-2011-1013

CVE-2011-1013 is an integer signedness error in the drm_modeset_ctl ioctl handling that affects the Linux kernel prior to 2.6.38 and OpenBSD prior to 4.9, allowing local users to trigger out-of-bounds writes and potentially crash the system or cause other impact via a crafted vb_num in an ioctl. ...

CVE-2011-4330

CVE-2011-4330 describes a stack-based buffer overflow in the Linux kernel 2.6, specifically in hfs_mac2asc (fs/hfs/trans.c). A crafted HFS image len field can be used by a local user to trigger a crash and, per the description, possibly execute arbitrary code. The associated connected documents c...

CVE-2012-4542

CVE-2012-4542 describes a Linux kernel local access issue in block/scsi_ioctl.c (up to kernel 3.8) where SCSI command authorization does not properly account for the SCSI device class, allowing a local attacker to bypass access restrictions via SG_IO ioctl with overlapping opcodes. Public referen...

CVE-2014-8709

The CVE affects the Linux kernel: ieee80211_fragment in net/mac80211/tx.c, vulnerable in versions before 3.13.5 due to an improperly maintained tail pointer which can allow remote attackers to read packets and obtain cleartext information. A fix is available in Linux kernel 3.13.5 and later (see ...