CVE-2026-46266

Summary (CVE-2026-46266): In the Linux kernel, RAW sockets using IPPROTO_RAW (255) could be triggered by a malicious incoming ICMP packet that sets the protocol field to 255 and matches a RAW socket, causing undesired FNHE cache changes. This issue has been resolved in updates cited across multip...

CVE-2009-1072

CVE-2009-1072 affects the Linux kernel prior to 2.6.28.9. nfsd in the kernel does not drop the CAP_MKNOD capability before handling a user request in a thread, enabling local users on an exported filesystem using root_squash to create device nodes. MiracleLinux 3 lists this as fixed in kernel-2.6...

CVE-2009-1192

CVE-2009-1192 affects the Linux kernel AGP subsystem (drivers/char/agp/generic.c) where two functions, agp_generic_alloc_page and agp_generic_alloc_pages, do not zero out pages that may later be exposed to a user-space process. This can allow local users to read pages and obtain sensitive informa...

CVE-2010-3296

CVE-2010-3296 affects the Linux kernel driver cxgb3 (cxgb_extension_ioctl in drivers/net/cxgb3/cxgb3_main.c). The advisory states that the code path in kernels up to 2.6.36-rc5 does not properly initialize a structure member, allowing a local user to potentially read sensitive data from kernel st...

CVE-2010-3880

CVE-2010-3880 affects the Linux kernel (net/ipv4/inet_diag.c) prior to 2.6.37-rc2. The issue is improper auditing of INET_DIAG bytecode, enabling a local user to trigger a kernel infinite loop and cause a denial of service via crafted INET_DIAG_REQ_BYTECODE instructions in a netlink message conta...

CVE-2010-4075

The CVE-2010-4075 entry affects the Linux kernel module code: uart_get_count (drivers/serial/serial_core.c) in versions prior to 2.6.37-rc1. The vulnerability arises from not properly initializing a certain structure member, enabling local users to read potentially sensitive information from kern...

CVE-2011-1013

CVE-2011-1013 is an integer signedness error in the drm_modeset_ctl ioctl handling that affects the Linux kernel prior to 2.6.38 and OpenBSD prior to 4.9, allowing local users to trigger out-of-bounds writes and potentially crash the system or cause other impact via a crafted vb_num in an ioctl. ...

CVE-2011-4330

CVE-2011-4330 describes a stack-based buffer overflow in the Linux kernel 2.6, specifically in hfs_mac2asc (fs/hfs/trans.c). A crafted HFS image len field can be used by a local user to trigger a crash and, per the description, possibly execute arbitrary code. The associated connected documents c...

CVE-2012-4542

CVE-2012-4542 describes a Linux kernel local access issue in block/scsi_ioctl.c (up to kernel 3.8) where SCSI command authorization does not properly account for the SCSI device class, allowing a local attacker to bypass access restrictions via SG_IO ioctl with overlapping opcodes. Public referen...

CVE-2014-8709

The CVE affects the Linux kernel: ieee80211_fragment in net/mac80211/tx.c, vulnerable in versions before 3.13.5 due to an improperly maintained tail pointer which can allow remote attackers to read packets and obtain cleartext information. A fix is available in Linux kernel 3.13.5 and later (see ...

CVE-2015-0573

CVE-2015-0573 affects the Linux kernel 3.x TSC driver (drivers/media/platform/msm/broadcast/tsc.c) as used in Qualcomm Innovation Center (QuIC) Android MSM builds. The vulnerability is a use of the TSC_GET_CARD_STATUS ioctl that can trigger an invalid pointer dereference, leading to a denial of s...

CVE-2015-8787

The CVE-2015-8787 entry concerns the Linux kernel, specifically the nf_nat_redirect_ipv4() function in net/netfilter/nf_nat_redirect.c. The vulnerability arises in kernel builds before 4.4, where remote attackers can send IPv4 packets to an incompletely configured interface to trigger a NULL poin...

CVE-2015-8962

CVE-2015-8962: Double free in sg_common_write (drivers/scsi/sg.c) of the Linux kernel before 4.4. A local user can gain privileges or cause memory corruption/system crash by detaching a device during an SG_IO ioctl. Remediation: upgrade to Linux kernel 4.4+ or apply vendor patch; exploitation con...

CVE-2017-8064

The CVE refers to Linux kernel 4.9.x and 4.10.x before 4.10.12 where the DVB-USB core (drivers/media/usb/dvb-usb-v2/dvb_usb_core.c) interacts incorrectly with CONFIG_VMAP_STACK. This can allow a local attacker to cause a denial of service (system crash or memory corruption) or other impact by abu...

CVE-2018-14614

CVE-2018-14614 concerns a Linux kernel issue up to version 4.17.10 where mounting an f2fs image triggers an out-of-bounds access in __remove_dirty_segment() within fs/f2fs/segment.c. Publicly documented details identify the affected component as the kernel’s f2fs filesystem driver, with a local a...

CVE-2019-10125

CVE-2019-10125 affects the Linux kernel (up to v5.0.4) where aio_poll() in fs/aio.c may release a file by aio_poll_wake() after vfs_poll() returns, causing a use-after-free. Connected advisories (Unity Linux UTSA entries) reproduce the vulnerable description and map the issue to kernel code path ...

CVE-2021-47459

CVE-2021-47459 describes a use-after-free in the Linux kernel can: j1939: j1939_netdev_start() related to rx_kref of j1939_priv. The issue arises during j1939_sk_bind and netdev_start when rx_kref is accessed without proper synchronization. Public advisories indicate this is fixed by kernel updat...

CVE-2022-48771

The CVE-2022-48771 issue affects the Linux kernel drm/vmwgfx: a failing usercopy of the fence_rep object can leave a stale file descriptor entry because put_unused_fd() isn’t released; this can let userland reference a dangling file descriptor and enable use-after-free scenarios. The fix defers t...

CVE-2022-48921

Summary of CVE-2022-48921 : In the Linux kernel, a race between sched_post_fork() and setpriority(PRIO_PGRP) for a thread group can trigger a NULL pointer dereference in reweight_entity() (part of CFS). The scenario: a main process spawns multiple new threads that then call setpriority, while sch...

CVE-2022-48990

CVE-2022-48990 affects the Linux kernel (drm/amdgpu) where a use-after-free could occur during GPU recovery due to fw_fence not being initialized before amdgpu_job_free_cb frees a job. The publicly provided details state the fix is in drm/amdgpu: fix use-after-free during gpu recovery, addressing...

CVE-2022-49033

CVE-2022-49033 affects the Linux kernel’s btrfs qgroup code, where a sleep was performed in an invalid context during qgroup inheritance. The advisory and connected documents describe the fix as: call qgroup_dirty() on the destination qgroup and update the limit item in btrfs_run_qgroups() later,...

CVE-2022-49086

CVE-2022-49086 affects the Linux kernel Open vSwitch actions: during parsing user-provided actions, the ovs_openvswitch module can allocate memory and leak it when destroying actions due to nested actions not being freed. The root cause is that several actions can hold nested lists of actions and...

CVE-2022-49152

CVE-2022-49152 affects the Linux kernel XArray feature, specifically the xas_create_range() path. When an existing entry with order >= XA_CHUNK_SHIFT is present, xas_create_range() can misinterpret it as a node and dereference xa_node->parent, potentially causing a crash (general protection...

CVE-2022-49300

CVE-2022-49300 affects the Linux kernel nbd subsystem. A race occurs when the nbd module is removed: nbd_genl_connect() may call nbd_alloc_config() concurrently, and although try_module_get() can fail, nbd_alloc_config() previously did not handle that. This can cause leakage of nbd_config and rel...

CVE-2022-49309

CVE-2022-49309 (Linux kernel) describes a deadlock in drivers: staging: rtl8723bs, specifically in rtw_surveydone_event_callback(). The issue occurs when a thread holds pmlmepriv->lock inside the callback and calls del_timer_sync() to stop a timer that is also needed by the timer handler, caus...

CVE-2022-49332

CVE-2022-49332 relates to the Linux kernel SCSI lpfc path. The vulnerability is a NULL pointer dereference in starget_to_rport() where calls may return NULL and the code could dereference a NULL rport. The described root cause is lack of a NULL check before dereferencing the rport, with the cited...

CVE-2022-49407

CVE-2022-49407 : Linux kernel dlm plock invalid read, fixed in the patch that moves the callback field into struct plock_op and adjusts handling for plock_xop. The issue arose when a sequence (unlock -> send_op -> append to send_list) could lead to a dev_write() path treating a plock_op as ...

CVE-2022-49787

Summary (CVE-2022-49787): In the Linux kernel, the mmc: sdhci-pci fix prevents a memory leak by ensuring proper PCI device reference counting. The root cause is that pci_get_device() increases the pci_dev reference count and may not be balanced with pci_dev_put() before amd_probe() returns; the f...

CVE-2023-31082

CVE-2023-31082 : In Linux kernel 6.2, the issue arises from a sleeping function invoked from an invalid context in gsmld_write (drivers/tty/n_gsm.c), which can block the kernel. The vulnerability is explicitly tied to the affected component and context, with the impact described as potentially ca...

CVE-2023-37454

CVE-2023-37454 affects the Linux kernel up to 6.4.2. It stems from a use-after-free in udf_put_super and udf_close_lvid triggered by a crafted UDF filesystem image in fs/udf/super.c. The external reference notes a different SUSE perspective. The provided connected documents do not specify a vendo...

CVE-2023-51781

CVE-2023-51781 affects the Linux kernel up to version before 6.6.8, with a use-after-free in atalk_ioctl (net/appletalk/ddp.c) caused by a race in atalk_recvmsg. The issue is locally exploitable and has a high impact on confidentiality/integity/availability per CVSS. A patch is available in kerne...

CVE-2023-51782

The CVE-2023-51782 issue affects the Linux kernel (net/rose/af_rose.c) and is a use-after-free in rose_ioctl caused by a race in rose_accept. Affected versions are before 6.6.8. The vulnerability can lead to local privilege escalation or kernel crash. Mitigation: upgrade to Linux kernel 6.6.8 or ...

CVE-2023-52693

The CVE-2023-52693 issue affects the Linux kernel ACPI video backlight code. Root cause: acpi_get_parent() can fail (e.g., acpi_ut_acquire_mutex() failure) and pass an uninitialized acpi_parent to acpi_get_pci_dev() during acpi_video_dev_register_backlight(). Impact: potential incorrect parent ha...

CVE-2023-52932

The CVE-2023-52932 issue concerns the Linux kernel mm/swapfile get_swap_pages(), where a plist_for_each_entry_safe() loop could loop tens of thousands of times under memory pressure, risking soft lockup. The fix adds cond_resched() into get_swap_pages() when space isn’t found, addressing softlock...

CVE-2023-53046

CVE-2023-53046 describes a race condition between hci_cmd_sync_work and hci_cmd_sync_clear in the Linux kernel Bluetooth subsystem, which can lead to a use-after-free and potentially a kernel panic. The issue arises when hci_cmd_sync_work is queued after a cancel_work_sync, allowing the cmd_sync_...

CVE-2023-53078

CVE-2023-53078 is a Linux kernel memleak in the SCSI ALUA path (scsi_dh_alua: alua_activate). The issue occurs if alua_rtpg_queue() fails during alua_activate(), leaving the allocated qdata unreleased and causing a memory leak. The public docs indicate the fix is to free qdata in the error path. ...

CVE-2023-53084

CVE-2023-53084 – Linux kernel (drm/shmem) 손상 문제 확인 Impact: In the Linux kernel, the error path in drm_gem_shmem_mmap() could fail to drop a reference, causing a dma-buf shmem GEM object to be freed prematurely and potentially leading to a use-after-free. Affected component: drm/shmem-helper and r...

CVE-2023-53097

CVE-2023-53097: In the Linux kernel powerpc IOMMU path, a memory leak occurs when using debugfs_lookup() because the result isn’t dput()-ed; the fix uses debugfs_lookup_and_remove() to handle the lookup and release in one step. The vulnerability is described as local, with potential high impact t...

CVE-2023-53108

CVE-2023-53108 – Linux kernel (net/iucv) : The vulnerability arises from incorrect sizing of iucv_irq_data, which must be 4 bytes larger. The under-allocation can permit a Redzone/heap corruption (dma-kmalloc-64) during iucv_init/cpu hotplug flow, with objects showin g incomplete frees in the obs...

CVE-2024-26824

CVE-2024-26824 affects the Linux kernel crypto/algif_hash: hashing a zero-length message could trigger a faulty SG list free on error. The fix removes freeing the SG list on the zero-length error path; kernel updates implementing this change are the remediation.

CVE-2024-36914

CVE-2024-36914 refers to a Linux kernel issue in drm/amd/display: writeback paths were incorrectly handled for DRM_MODE_CONNECTOR_WRITEBACK, causing KASAN slab-out-of-bounds messages. The root cause is a dynamic memory safety error detector triggering when writeback connectors do not initialize c...

CVE-2024-38578

The CVE-2024-38578 issue is a Linux kernel vulnerability in ecryptfs: the buffer for the TAG 66 packet was 3 bytes too small, causing a potential write past the end (KASAN slab-out-of-bounds). The fix increases the allocation size to ensure the entire packet fits, addressing the bug described in ...

CVE-2024-41072

CVE-2024-41072 affects the Linux kernel wifi subsystem (cfg80211 wext). The fix adds an extra validation in cfg80211_wext_siwscan() to ensure the number of channels passed via ioct(SIOCSIWSCAN, ...) does not exceed IW_MAX_FREQUENCIES; requests that exceed this limit are rejected with -EINVAL. Thi...

CVE-2024-42074

CVE-2024-42074 pertains to the Linux kernel’s ASoC AMD ACP driver. When the acp platform device creation is skipped, chip->chip_pdev can be NULL, leading to a potential NULL pointer dereference in snd_acp_resume. The connected Nessus/NASL entries confirm the root cause and describe the fix: ad...

CVE-2024-42236

In CVE-2024-42236, the Linux kernel vulnerability affects usb: gadget: configfs, specifically usb_string_copy(), where an userspace string with length zero can bypass validation, causing an OOB read (str[0-1] before check) followed by an OOB write (str[0-1] = '\0'). The issue is caused by insuffi...

CVE-2024-43859

CVE-2024-43859 affects the Linux kernel with the f2fs filesystem. The root cause is an uninitialized inode.i_crypt_info during mount paths that involve f2fs_gc/truncate, leading to a NULL pointer dereference in fscrypt-related code when handling preallocated blocks. The documented mitigation is t...

CVE-2024-43861

CVE-2024-43861 affects the Linux kernel (net/usb/qmi_wwan) where a memory leak could occur for non-IP packets due to an unused skb not being freed. The description in Connected documents confirms the fix: freeing the unused skb when non-IP packets arrive. The CIRCL/CVE sighting shows related advi...

CVE-2024-43880

CVE-2024-43880 affects the Linux kernel mlxsw spectrum ACL (Spectrum-2 and newer). The vulnerability arises from how ACLs could be migrated between A-TCAM and C-TCAM using the objagg mask aggregation, where the driver and lib compared masks without respecting TCAM context, potentially creating ne...

CVE-2024-46721

CVE-2024-46721 covers a NULL-pointer dereference in the Linux kernel’s AppArmor path when creating profiles. The issue arises in aafs_create.constprop.0 within aa_replace_profiles, where profile->parent->dents[AAFS_PROF_DIR] could be NULL if the parent was created by __create_missing_ancest...

CVE-2024-46736

The connected document BDU:2026-03544 describes CVE-2024-46736 as a Linux kernel SMB client issue in fs/smb/client/smb2inode.c: the smb2_rename_path() path could double-put the @cfile when smb2_set_path_attr() returns -EINVAL, leading to potential confidentiality/integrity/access impact. The entr...