CVE-2024-44950

CVE-2024-44950 affects the Linux kernel’s serial driver for sc16is7xx. The issue arises when enabling the special register set: the IRQ path can read the FIFO through RHR at address 0x00, which is actually DLL, causing erroneous FIFO reads and timeouts. Root cause documented as invalid FIFO acces...

CVE-2024-46736

The connected document BDU:2026-03544 describes CVE-2024-46736 as a Linux kernel SMB client issue in fs/smb/client/smb2inode.c: the smb2_rename_path() path could double-put the @cfile when smb2_set_path_attr() returns -EINVAL, leading to potential confidentiality/integrity/access impact. The entr...

CVE-2024-46813

CVE-2024-46813 affects the Linux kernel drm/amd/display code. The fix guards against out-of-bounds access by validating link_index before dereferencing dc->links[], where dc->links[] has a max size of MAX_LINKS; the issue could cause 3 overrun conditions and a resource leak, resolved by the...

CVE-2024-46818

CVE-2024-46818 affects the Linux kernel’s DRM/AMD display driver. The root cause is using GPIO_ID_UNKNOWN (-1) as an array index; a patch adds a pre-check before indexing the gpio_id, fixing 5 Coverity-reported overrun issues. The vulnerability is addressed in kernel updates that include the drm/...

CVE-2024-46836

CVE-2024-46836 in the Linux kernel affects usb: gadget: aspeed_udc. The issue is a missing bound check for the endpoint index, which may allow an out-of-bounds access to the endpoint array if the host manipulates the index. Descriptions and Nessus references confirm this bound-check root cause an...

CVE-2024-47667

The CVE-2024-47667 entry describes a Linux kernel PCI keystone Errata #i2037 workaround for AM65x SR 1.0: limit inbound PCIe TLPs so that maximum read request size and maximum payload size are 128 bytes. This fix is specific to AM65x SR 1.0; later silicon revisions include the fix. Publicly avail...

CVE-2024-47741

In CVE-2024-47741, the Linux kernel’s btrfs code had a race when multiple threads perform lseek (SEEK_DATA/SEEK_HOLE) on the same file descriptor. The bug stems from find_desired_extent() grabbing the file’s private_data while it may be NULL, allowing two threads to allocate separate file private...

CVE-2024-49908

CVE-2024-49908: In the Linux kernel, the AMDGPU display driver (amdgpu_dm) had a missing null check for theafb in amdgpu_dm_update_cursor, risking a null pointer dereference. The fix adds a null check and moves the check to the point of use (line where afb is accessed). Affects drm/amd/display co...

CVE-2024-49988

The CVE-2024-49988 issue concerns the ksmbd kernel SMB server: during an oplock break, opinfo->conn could be used after ksmbd_conn is freed in multichannel scenarios. The fix adds a reference count to ksmbd_conn to ensure it is not freed while still in use. This is a Linux kernel-level vulnera...

CVE-2024-50223

CVE-2024-50223: In Linux kernel sched/numa, a potential null pointer dereference in task_numa_work() could occur when a stress scenario unmapped a child address space, causing vma_next() to return NULL. The backtrace shows dereferencing a NULL vma in vma_migratable, leading to a crash. Root cause...

CVE-2024-50298

Public details for CVE-2024-50298 are not provided in the connected documents; the initial description contains details, but there are no additional technical specifics available here.

CVE-2024-53221

Technical details about CVE-2024-53221 (affected products/versions, impact, and fixes) are not provided in the supplied documents. Public specifics are not available here; please monitor for updates from official advisories or connected sources.

CVE-2024-54456

CVE-2024-54456 : Linux kernel NFS path vulnerability in nfs_sysfs_link_rpc_client() leading to potential buffer overflow due to strcat on cl_program->name; fix replaces with strscpy() and strncat() (kernel-side patch). Affected: Linux kernel NFS subsystem; root cause: unbounded name field size...

CVE-2024-56621

CVE-2024-56621 affects the Linux kernel SCSI/UFS subsystem. The root cause was that RTC work was cancelled only during __ufshcd_wl_suspend(), not when ufshcd is removed, allowing RTC work to run on removed internal ufshcd structures and potentially dereference NULL. The fix cancels RTC work durin...

CVE-2024-56622

Summary: CVE-2024-56622 is a Linux kernel vulnerability in the SCSI UFS core sysfs path that can trigger a division by zero when monitoring is disabled. The issue is tracked across multiple vendors/distros with fixed releases: Debian LTS advisory DLA-4076-1 notes a fix in linux-6.1-6.1.6.1.128-1~...

CVE-2024-58056

The CVE-2024-58056 entry documents a Linux kernel remoteproc issue in which rproc_alloc() can trigger ida_free() via rproc_type_release() on an error path before ida_alloc() has been called. The underlying cause is rproc->index being initialized to 0, making rproc->index >= 0 true when t...

CVE-2025-21738

CVE-2025-21738 describes a Linux kernel vulnerability in the ata libata-sff path where ata_pio_sector() could write outside the allocated buffer, potentially corrupting memory. The issue arises when handling a SCSI_IOCTL_SEND_COMMAND (out_len 0xd42) with SCSI command ATA_16 PASS-THROUGH, ATA_NOP,...

CVE-2025-21829

CVE-2025-21829 affects the Linux kernel RDMArxe; a warning in __rxe_cleanup and rxe resource handling could cause improper resource release under high rdma load. The issue is resolved by a kernel fix that increases the timeout for rdma resource teardown, with commits in the stable/rxe flow (examp...

CVE-2025-22012

The CVE-2025-22012 entry concerns the Linux kernel arm64/dts path: qcom/sdm845. The underlying issue relates to pagetable walker cache coherency, causing lock-ups and device-specific resets on SDM845/850 devices (e.g., Dragonboard 845c vs. Lenovo Yoga C630). The resolution described in the docume...

CVE-2025-22033

CVE-2025-22033: Linux kernel arm64 fix for a NULL pointer dereference in alignment handling. The issue occurs when do_alignment_t32_to_handler() fixes only specific instructions and returns NULL for others (e.g., LDREX); callers would proceed with regular alignment fault handling (SIGBUS). Withou...

CVE-2025-22115

CVE-2025-22115 affects the Linux kernel Btrfs code, specifically a race in btrfs_create_pending_block_groups() that mishandles block group refcounts during a two‑phase creation. The fix introduced BLOCK_GROUP_FLAG_NEW but did not use unused_bg_lock, allowing a race between btrfs_create_pending_bl...

CVE-2025-37739

CVE-2025-37739 involves a Linux kernel issue in the f2fs filesystem where out-of-bounds access could occur during truncate_inode_blocks(). UBSAN reported an array-index-out-of-bounds in f2fs/node.h when get_nid() accessed i_nid with a negative index due to dn.ofs_in_node being zero while the load...

CVE-2025-37801

Summary: CVE-2025-37801 affects the Linux kernel driver for SPI on i.MX cores. The root cause is that after spi_imx_setupxfer() returns an error, spi_imx->rx and spi_imx->tx function pointers may be NULL, leading to a NULL pointer dereference during SPI transfers (spi_imx_pio_transfer , etc...

CVE-2025-37831

Affected software: Linux kernel cpufreq subsystem on Apple SoCs. Issue: cpufreq_cpu_get_raw() may return NULL when the target CPU is not present in policy->cpus mask, and apple_soc_cpufreq_get_rate() does not check for this, leading to a NULL pointer dereference. Root cause: missing NULL check...

CVE-2025-37947

CVE-2025-37947 affects ksmbd (Linux kernel SMBv3 server). Root cause: ksmbd_vfs_stream_write() could perform an out-of-bounds write when *pos >= v_len due to missing bounds check; patch adds a check to ensure *pos

CVE-2025-38022

The CVE-2025-38022 issue resides in the Linux kernel RDMA/core where KASAN reports a slab-use-after-free Read in ib_register_device. Root cause: ib_device_rename() renames the device name under a lock while kobject_uevent() accesses the name without lock protection, leading to a race. The fix is ...

CVE-2025-38177

CVE-2025-38177 affects the Linux kernel’s scheduling subsystem (sch_hfsc). The documented fix makes hfsc_qlen_notify() idempotent to improve safety for callers such as qdisc_tree_reduce_backlog(). The described changes include guarding update_vf() (checking cl_nactive) and safely removing RB node...

CVE-2025-38396

The CVE-2025-38396 entry concerns the Linux kernel vulnerability where anon_inode_make_secure_inode() is exported to allow KVM guest_memfd to create anonymous inodes with proper security context, fixing a secretmem LSM bypass. The issue involved the S_PRIVATE flag not being cleared after alloc_an...

CVE-2025-40114

Technical details for CVE-2025-40114 are not publicly provided in the connected documents. The advisories reference the CVE but do not expose specifics here. Monitor official vendor/security bulletins for updates.

CVE-2009-1336

CVE-2009-1336 affects the Linux kernel (before 2.6.23) in the NFS client path. The issue is that a structure member that stores the maximum NFS filename length is not properly initialized, related to the encode_lookup function. This allows local users to trigger a denial of service (OOPS) by usin...

CVE-2009-4020

CVE-2009-4020 describes a stack-based buffer overflow in the Linux kernel 2.6.32 hfs subsystem (fs/hfs/dir.c, hfs_readdir). A crafted Hierarchical File System (HFS) filesystem could allow an attacker to achieve an unspecified impact via the HFS filesystem. Several Nessus/GD advisories link this C...

CVE-2010-3067

CVE-2010-3067 affects the Linux kernel: an integer overflow in do_io_submit (fs/aio.c) in versions before 2.6.36-rc4-next-20100915 allows local users to cause a denial of service or possibly other impact via crafted io_submit usage. The vulnerability is rooted in improper handling within the io_s...

CVE-2010-4346

The vulnerability CVE-2010-4346 affects the Linux kernel: install_special_mapping in mm/mmap.c before 2.6.37-rc6 does not call security_file_mmap as expected, allowing local users to bypass mmap_min_addr restrictions and potentially trigger NULL pointer dereference via a crafted assembly-language...

CVE-2011-1080

CVE-2011-1080 affects the Linux kernel prior to 2.6.39 via the do_replace path in net/bridge/netfilter/ebtables.c. The issue: a name field may not end with a null terminator, enabling a local user with CAP_NET_ADMIN to replace a bridge table and read potentially sensitive data from kernel stack m...

CVE-2011-2918

CVE-2011-2918 affects the Linux kernel perf subsystem (Performance Events). The issue arises in the handling of event overflows for PERF_COUNT_SW_CPU_CLOCK, enabling a local attacker to cause a denial of service (system hang) via a crafted application. Public references in connected advisories co...

CVE-2012-1601

CVE-2012-1601 concerns the KVM component of the Linux kernel. The vulnerability exists in the KVM implementation prior to version 3.3.6 and can be triggered by a host OS user making a KVM_CREATE_IRQCHIP ioctl after a virtual CPU already exists. The issue may lead to a NULL pointer dereference and...

CVE-2012-2375

CVE-2012-2375 affects the Linux kernel NFSv4 implementation where __nfs4_get_acl_uncached in fs/nfs/nfs4proc.c uses an incorrect length variable during a copy, enabling remote NFS servers to trigger a denial of service (OOPS) by sending excessive bitmap words in an FATTR4_ACL reply. Affected are ...

CVE-2014-2706

CVE-2014-2706 describes a race condition in the Linux kernel’s mac80211 subsystem (sta_info.c and tx.c) that, when handling network traffic in conjunction with the WLAN_STA_PS_STA (power-save) state, can cause a remote denial of service (system crash). The issue affects kernel versions prior to 3...

CVE-2014-4171

CVE-2014-4171 affects mm/shmem.c in the Linux kernel up to 3.15.1. The issue is that the interaction between range notification and hole punching is not properly implemented, allowing a local user to cause a denial of service (i_mutex hold) by using mmap to access a hole. Demonstrations in the so...

CVE-2015-6252

CVE-2015-6252 refers to a vulnerability in the Linux kernel where the vhost_dev_ioctl path in drivers/vhost/vhost.c allows local users to trigger a denial of service (memory consumption) by issuing a VHOST_SET_LOG_FD ioctl that can cause permanent file-descriptor allocation. The description speci...

CVE-2015-8551

CVE-2015-8551 affects the Xen PCI backend driver (pciback) when Xen runs on x86 with a Linux 3.1.x–4.3.x driver domain. The issue arises from missing sanity checks in XEN_PCI_OP_* operations, allowing a local guest administrator with access to a passed-through MSI/MSI-X PCI device to trigger BUG ...

CVE-2019-10142

CVE-2019-10142 references a flaw in the Linux kernel's freescale hypervisor manager implementation. A parameter passed to an ioctl was not properly validated and was used in size calculations for page size, making the kernel vulnerable on 5.0.x kernels before 5.0.17. Exploitation could crash the ...

CVE-2019-16229

CVE-2019-16229 affects the Linux kernel (example: kernel version 5.2.14) where a NULL pointer dereference can occur because kfd_interrupt.c in amdkfd does not check the return value of alloc_workqueue. The Unity Nessus advisory reiterates this description and notes the security community disputes...

CVE-2021-47082

CVE-2021-47082 affects the Linux kernel tun/tun.c: a double-free in tun_free_netdev is caused by deferring dev->tstats and tun->security allocations to a new ndo_init routine (tun_net_init) that runs via register_netdevice(). If register_netdevice() fails, the destructor previously would no...

CVE-2021-47459

CVE-2021-47459 describes a use-after-free in the Linux kernel can: j1939: j1939_netdev_start() related to rx_kref of j1939_priv. The issue arises during j1939_sk_bind and netdev_start when rx_kref is accessed without proper synchronization. Public advisories indicate this is fixed by kernel updat...

CVE-2022-3104

The CVE-2022-3104 entry concerns the Linux kernel (up to 5.16-rc6) where lkdtm_ARRAY_BOUNDS in drivers/misc/lkdtm/bugs.c does not check the return value of kmalloc(), enabling a NULL pointer dereference. Affected software is the Linux kernel, with root cause in unchecked kmalloc return leading to...

CVE-2022-48674

CVE-2022-48674 - erofs use-after-free on UP platforms : Linux kernel patch fixes a race in erofs where erofs_workgroup_unfreeze() doesn’t reset orig_val, allowing a pcluster to be reused after free. This leads to a use-after-free in paths such as z_erofs_do_read_page/z_erofs_readahead under stres...

CVE-2022-48921

Summary of CVE-2022-48921 : In the Linux kernel, a race between sched_post_fork() and setpriority(PRIO_PGRP) for a thread group can trigger a NULL pointer dereference in reweight_entity() (part of CFS). The scenario: a main process spawns multiple new threads that then call setpriority, while sch...

CVE-2022-49263

The CVE-2022-49263 case concerns a Linux kernel flaw in the brcmfmac: pcie path. The vulnerability is described as a memory-leak in the error path of brcmf_pcie_setup where firmware release occurs after brcmf_chip_get_raminfo fails; the CLM blob is released in the device remove path. Connected ad...

CVE-2022-49348

In Linux kernels affected by CVE-2022-49348, the EXT4_FC_REPLAY bit in sbi->s_mount_state was causing a risk: a corrupted on-disk superblock could set EXT4_FC_REPLAY in s_mount_state, bypassing sanity checks and triggering a BUG() in ext4_es_cache_extent(). The available connected documents co...