CVE-2025-37911

The CVE-2025-37911 vulnerability affects the bnxt_en driver in the Linux kernel. It arises when ethtool -w retrieves a FW core dump: the DMA’d segment list length reported by the FW can exceed the allocated info->dest_buf, causing an out-of-bounds copy and memory corruption. Root cause is an u...

CVE-2024-46714

CVE-2024-46714 in the Linux kernel is addressed by a fix in the DRM/AMD display path: the code now skips the wbscl_set_scaler_filter when the filter is null, preventing a potential NULL return from wbscl_get_filter_coeffs_16p from causing a null dereference. A null check was added to ensure filte...

CVE-2024-56550

The CVE-2024-56550 affects the Linux kernel (s390 architecture). The underlying issue was a return statement in arch_stack_walk_user_common() that could be executed when store_ip() fails, instead of a break. This could skip pagefault_enable(), causing subsequent page faults to be mishandled and p...

CVE-2024-58016

CVE-2024-58016 (Linux kernel) fixes a safesetid vulnerability where syzbot could cause a kmalloc warning by writing an oversized buffer to a sysfs entry; the vulnerability arises from insufficient validation of write buffer sizes in handle_policy_update() and policy writes. The fix is to validate...

CVE-2024-58054

CVE-2024-58054 concerns the Linux kernel staging media driver for max96712. The issue causes a kernel oops when removing the module, due to a pointer mix-up in v4l2_i2c_subdev_init(): i2c_set_cliendata() overwrites the private pointer with the struct driver data (sd) instead of the driver’s priva...

CVE-2024-58056

The CVE-2024-58056 entry documents a Linux kernel remoteproc issue in which rproc_alloc() can trigger ida_free() via rproc_type_release() on an error path before ida_alloc() has been called. The underlying cause is rproc->index being initialized to 0, making rproc->index >= 0 true when t...

CVE-2025-21829

CVE-2025-21829 affects the Linux kernel RDMArxe; a warning in __rxe_cleanup and rxe resource handling could cause improper resource release under high rdma load. The issue is resolved by a kernel fix that increases the timeout for rdma resource teardown, with commits in the stable/rxe flow (examp...

CVE-2025-22012

The CVE-2025-22012 entry concerns the Linux kernel arm64/dts path: qcom/sdm845. The underlying issue relates to pagetable walker cache coherency, causing lock-ups and device-specific resets on SDM845/850 devices (e.g., Dragonboard 845c vs. Lenovo Yoga C630). The resolution described in the docume...

CVE-2025-22033

CVE-2025-22033: Linux kernel arm64 fix for a NULL pointer dereference in alignment handling. The issue occurs when do_alignment_t32_to_handler() fixes only specific instructions and returns NULL for others (e.g., LDREX); callers would proceed with regular alignment fault handling (SIGBUS). Withou...

CVE-2025-37854

CVE-2025-37854 affects the Linux kernel drm/amdkfd path. A use-after-free race occurs when mode1 reset is used to recover a hung GPU: after KFD signals user space to abort, the cleanup may free or reuse system memory (and VRAM) still in use by user queues, potentially corrupting data structures a...

CVE-2025-37864

CVE-2025-37864 relates to the Linux kernel DSA subsystem: a cleanup path for FDB, MDB and VLAN entries on unbind was added to fix a scenario where bridge bypass operations could leave stale entries and trigger a leak/warn on unbind. The vulnerability stems from the assumption that higher layers b...

CVE-2025-38117

Summary: CVE-2025-38117 affects the Linux kernel Bluetooth MGMT path, specifically the mgmt_pending list. The root cause is a concurrency issue where the list access could lead to a slab-use-after-free in hci_sock_get_channel, triggering a crash under KASAN reports. The vulnerability is mitigated...

CVE-2008-0600

The Linux kernel versions 2.6.17 through 2.6.24.1 are vulnerable to a memory access flaw in the vmsplice_to_pipe function. This vulnerability stems from a failure to validate a specific userspace pointer before dereferencing it. A local attacker can exploit this by providing crafted arguments to ...

CVE-2009-0675

CVE-2009-0675 affects the Linux kernel up to version 2.6.28.6, where the skfp_ioctl function in drivers/net/skfp/skfddi.c incorrectly allows SKFP_CLR_STATS requests when CAP_NET_ADMIN is absent rather than present, enabling local users to reset driver statistics (inverted logic). The vulnerabilit...

CVE-2010-4346

The vulnerability CVE-2010-4346 affects the Linux kernel: install_special_mapping in mm/mmap.c before 2.6.37-rc6 does not call security_file_mmap as expected, allowing local users to bypass mmap_min_addr restrictions and potentially trigger NULL pointer dereference via a crafted assembly-language...

CVE-2012-2375

CVE-2012-2375 affects the Linux kernel NFSv4 implementation where __nfs4_get_acl_uncached in fs/nfs/nfs4proc.c uses an incorrect length variable during a copy, enabling remote NFS servers to trigger a denial of service (OOPS) by sending excessive bitmap words in an FATTR4_ACL reply. Affected are ...

CVE-2014-5472

The CVE-2014-5472 entry affects the Linux kernel up to 3.16.1, where the parse_rock_ridge_inode_internal function in fs/isofs/rock.c is exploitable by local users via a crafted iso9660 image with a self-referential CL entry to cause a denial-of-service (unkillable mount process). Connected Nessus...

CVE-2015-0570

CVE-2015-0570 is a stack-based buffer overflow in the SET_WPS_IE IOCTL in wlan_hdd_hostapd.c of the Linux kernel WLAN driver (3.x/4.x), as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and similar products. Exploitation requires a crafted application with a long ...

CVE-2015-8551

CVE-2015-8551 affects the Xen PCI backend driver (pciback) when Xen runs on x86 with a Linux 3.1.x–4.3.x driver domain. The issue arises from missing sanity checks in XEN_PCI_OP_* operations, allowing a local guest administrator with access to a passed-through MSI/MSI-X PCI device to trigger BUG ...

CVE-2018-12928

CVE-2018-12928 concerns Linux kernel 4.15.0 where a NULL pointer dereference can occur in hfs_ext_read_extent within hfs.ko during mounting a crafted HFS filesystem. Connected advisories note the issue in kernel packages and reference a security update (ELSA) and Nessus entries indicating affecte...

CVE-2018-13100

CVE-2018-13100 concerns the Linux kernel, specifically fs/f2fs/super.c up to version 4.17.3, where improper validation of secs_per_zone in a corrupted f2fs image can trigger a divide-by-zero error. The connected advisories confirm the issue and reproduce conditions but do not provide a patch vers...

CVE-2021-28039

CVE-2021-28039 affects the Linux kernel 5.9.x–5.11.3 (used with Xen). In some configurations, an x86 PV guest OS user can crash the Dom0 or a driver domain by generating a large amount of I/O. Root cause is the misuse of guest physical addresses when CONFIG_XEN_UNPOPULATED_ALLOC is set but CONFIG...

CVE-2021-47082

CVE-2021-47082 affects the Linux kernel tun/tun.c: a double-free in tun_free_netdev is caused by deferring dev->tstats and tun->security allocations to a new ndo_init routine (tun_net_init) that runs via register_netdevice(). If register_netdevice() fails, the destructor previously would no...

CVE-2022-48659

CVE-2022-48659 is a Linux kernel issue localized to mm/slub where kmalloc() can fail with an OOM, and the fix ensures create_unique_id() returns a proper errno instead of triggering BUG_ON(). The result is a kernel BUG at mm/slub.c:5893 in the failing path, with the stack showing sysfs_slab_add →...

CVE-2022-48666

The CVE-2022-48666 entry concerns the Linux kernel: scsi: core: Fix a use-after-free. The root cause involves two .exit_cmd_priv implementations that use resources tied to the SCSI host; the patch ensures those resources remain valid when exit_cmd_priv is invoked by scsi_remove_host() by waiting ...

CVE-2022-49390

The CVE-2022-49390 entry concerns a Linux kernel macsec vulnerability in which a new macsec device could be created without holding a reference to the underlying real_dev, enabling a use-after-free in macsec_get_iflink and related paths. Root cause: lack of proper reference handling for real_dev ...

CVE-2022-49664

CVE-2022-49664 affects the Linux kernel TIPC subsystem. The issue is a NULL pointer dereference in tipc_link_is_up caused by a BC link not yet created when a BC packet arrives during node creation. The patch fixes this by moving BC link creation to occur before inserting the new node into the has...

CVE-2023-32252

CVE-2023-32252 affects the Linux kernel ksmbd (the in-kernel SMB server). The flaw occurs in the handling of SMB2_LOGOFF commands due to improper validation of a pointer before access. This can allow an attacker to trigger a denial-of-service on the affected system. The description and connected ...

CVE-2023-4458

CVE-2023-4458 affects the Linux kernel ksmbd module, specifically in the parsing of extended attributes. The flaw stems from insufficient validation of user-supplied data, allowing an out-of-bounds read (read past the end of an allocated buffer) and enabling information disclosure on affected sys...

CVE-2023-52812

CVE-2023-52812 affects the Linux kernel in the DRM/AMD path for updating PCIe parameters in SR-IOV environments. The root cause is that pcie_table->num_of_link_levels can be 0, making num_of_levels − 1 evaluate to an invalid index and potentially causing an out-of-bounds access. The vulnerabil...

CVE-2023-53017

The CVE-2023-53017 entry concerns a memory leak in the Linux kernel Bluetooth stack (hci_sync path). Root cause: in hci_update_adv_data(), if hci_cmd_sync_queue() fails, the allocated inst_ptr was not freed. Mitigation: switch to using ERR_PTR/PTR_ERR to pass the instance to the callback, so no a...

CVE-2023-53089

CVE-2023-53089 affects the Linux kernel ext4/xattr path. The issue occurs during eviction of inodes with extended attributes (EA) where ext4_xattr_delete_inode triggers a hang due to finding an EA inode (ea_inum = 15) that is in I_FREEING state and waiting for the EA inode’s deletion, causing an ...

CVE-2024-35868

CVE-2024-35868 is a Linux kernel vulnerability related to the SMB/CIFS client: it fixes a potential use-after-free in cifs_stats_proc_write() by skipping sessions that are tearing down (status SES_EXITING). The issue is addressed in Linux kernel updates; multiple Red Hat advisories (RHSA-2026:053...

CVE-2024-35929

The CVE-2024-35929 issue affects the Linux kernel in the rcu_nocb path, specifically when CONFIG_RCU_NOCB_CPU_DEFAULT_ALL=y and CONFIG_RCU_LAZY=y. It can trigger WARN_ON_ONCE in rcu_nocb_bypass_lock() and rcu_nocb_wait_contended(), potentially exposing a local-privilege or local-execution impact ...

CVE-2024-36969

The CVE-2024-36969 issue affects the Linux kernel drm/amd/display component, specifically a division-by-zero in setup_dsc_config when slice_height is 0, which could crash the amdgpu driver and reboot the system. The patch introduces a guard to avoid dividing by zero (dc_dsc.c:1053; dc_dsc_compute...

CVE-2024-37021

Technical details for CVE-2024-37021 are not publicly available in the provided connected documents. The initial description references fpga_manager owner/refcount changes in the Linux kernel, but no further technical specifics (affected products/versions/fixes) are given here. Monitor for updates.

CVE-2024-39495

The CVE-2024-39495 issue is a Linux kernel use-after-free in greybus gb_interface_release caused by a race with gb_interface_mode_switch_work. The fix, confirmed by multiple sources (e.g., Astra Linux advisory reflecting the same description), is to cancel the scheduled work before freeing the ob...

CVE-2024-40939

CVE-2024-40939 (Linux kernel) : The issue affects the Linux kernel net/wwan/iosm path. When region creation fails in ipc_devlink_create_region(), the delete path used a tainted pointer that actually held an error code. The fix decreases the region index before performing the delete to avoid taint...

CVE-2024-46702

CVE-2024-46702 (Linux kernel) relates to Thunderbolt: when a router is removed, the code previously blocked cleanup of XDomain paths due to tb_disconnect_xdomain_paths() racing with tb_stop() during host router NVM upgrade. The fix marks the XDomain as unplugged during removal, allowing tb_stop()...

CVE-2024-46721

CVE-2024-46721 covers a NULL-pointer dereference in the Linux kernel’s AppArmor path when creating profiles. The issue arises in aafs_create.constprop.0 within aa_replace_profiles, where profile->parent->dents[AAFS_PROF_DIR] could be NULL if the parent was created by __create_missing_ancest...

CVE-2024-46736

The connected document BDU:2026-03544 describes CVE-2024-46736 as a Linux kernel SMB client issue in fs/smb/client/smb2inode.c: the smb2_rename_path() path could double-put the @cfile when smb2_set_path_attr() returns -EINVAL, leading to potential confidentiality/integrity/access impact. The entr...

CVE-2024-46789

CVE-2024-46789 (Linux kernel) details from connected documents show a concrete fix: in mm/slub, the tagging logic now checks s->flags in alloc_tagging_slab_free_hook to avoid calling alloc_tag_add when SLAB_NO_OBJ_EXT or SLAB_NOLEAKTRACE are set. This prevents the NULL ref (ref->ct) and the...

CVE-2024-46802

CVE-2024-46802 affects the Linux kernel’s DRM-AMD display path. The vulnerability is a NULL-dereference in drm/amd/display when validating a stream, caused by missing NULL checks for dc or stream. The fixed code adds a NULL check at the start of dc_validate_stream to prevent invalid memory access...

CVE-2024-46818

CVE-2024-46818 affects the Linux kernel’s DRM/AMD display driver. The root cause is using GPIO_ID_UNKNOWN (-1) as an array index; a patch adds a pre-check before indexing the gpio_id, fixing 5 Coverity-reported overrun issues. The vulnerability is addressed in kernel updates that include the drm/...

CVE-2024-46836

CVE-2024-46836 in the Linux kernel affects usb: gadget: aspeed_udc. The issue is a missing bound check for the endpoint index, which may allow an out-of-bounds access to the endpoint array if the host manipulates the index. Descriptions and Nessus references confirm this bound-check root cause an...

CVE-2024-49940

CVE-2024-49940 (Linux kernel) affects the l2tp code path and describes a tunnel refcount underflow window during session creation and tunnel refcount handling. Root cause details: a backpointer from a session to its tunnel is set in l2tp_session_create before the tunnel refcount is incremented by...

CVE-2024-50139

CVE-2024-50139 affects the Linux kernel KVM for ARM64. UBSAN reports a shift-out-of-bounds in arch/arm64/kvm/sys_regs.c (shift exponent 33 too large for 32-bit int) when running VMs with MTE-enabled host kernels. Affected component is the KVM arm64 path and the bug is fixed by a kernel patch (ref...

CVE-2024-50294

Summary (CVE-2024-50294): In the Linux kernel, the rxrpc subsystem vulnerability was resolved due to a race in removing a local list element when a call is aborted. If an abort occurs between queuing for connection and the I/O thread processing, the abort could be prioritized over the connection ...

CVE-2024-53045

Technical details for CVE-2024-53045 are not provided in the supplied documents. No specifics on affected products, root cause, impact, or fixes are included here. Monitor official advisories for updates.

CVE-2024-53115

Technical details for CVE-2024-53115 are not publicly disclosed in the provided connected documents. The initial description mentions a kernel fix for a null pointer dereference in vmw_framebuffer_surface_create_handle, but no product/version specifics or exploit info are given here. Monitor for ...