CVE-2026-31402

CVE-2026-31402 affects the Linux kernel NFSv4.0 server (nfsd) via the LOCK replay cache. A large lock owner in a denied LOCK can cause a slab-out-of-bounds write into the 112-byte replay buffer, corrupting adjacent heap memory. The issue can be triggered remotely by two cooperating NFSv4.0 client...

CVE-2002-0510

CVE-2002-0510 describes a fingerprinting flaw in the UDP/IP stack of Linux 2.4.x: the IP Identification field is kept at 0 for non-fragmented packets, enabling remote observers to determine if a target runs Linux. The available connected documents reiterate the Linux kernel vulnerability and refe...

CVE-2009-2406

CVE-2009-2406 refers to a stack-based buffer overflow in the parse_tag_11_packet function in fs/ecryptfs/keystore.c of the Linux kernel before 2.6.30.4. The issue arises from not ensuring that the key signature length in a Tag 11 packet is compatible with the key signature buffer size, enabling l...

CVE-2009-4536

CVE-2009-4536 affects the Linux kernel ≤ 2.6.32.3 in the e1000 (drivers/net/e1000/e1000_main.c): it mishandles frames larger than MTU by treating trailing payload as a full frame, allowing remote bypass of packet filters with a crafted large packet. The issue is described as a consequence of an i...

CVE-2010-2240

CVE-2010-2240 affects the Linux kernel via the do_anonymous_page function in mm/memory.c, where improper separation of the stack and heap allows context-dependent attackers to execute arbitrary code by writing to the bottom page of a shared memory segment, demonstrated by a memory-exhaustion atta...

CVE-2010-2524

CVE-2010-2524 affects the Linux kernel CIFS DNS upcall: when CONFIG_CIFS_DFS_UPCALL is enabled, DNS resolution relies on a user keyring via the dns_resolver upcall in the cifs.upcall userspace helper. This allows local privileged or nearby users to spoof DNS query results and mount arbitrary CIFS...

CVE-2010-4157

CVE-2010-4157 involves an integer overflow in the Linux kernel’s GDTH SCSI driver (gdth_ioctl_alloc/ioc_general) on 64-bit platforms. A 32/64-bit mismatch when handling a large argument in an ioctl can cause memory corruption, enabling a local user to trigger a denial of service (and potentially ...

CVE-2011-1171

CVE-2011-1171 affects the Linux kernel prior to 2.6.39, specifically the IPv4 netfilter ip_tables.c path. The issue is that string data in certain structure members may not end with the expected null terminator, enabling a local attacker with CAP_NET_ADMIN to craft a request and read the argument...

CVE-2011-4077

CVE-2011-4077 is a Linux kernel XFS-related vulnerability described in the provided documents as a buffer overflow in the xfs_readlink function (fs/xfs/xfs_vnodeops.c) when CONFIG_XFS_DEBUG is disabled. The issue affects Linux kernel 2.6 with XFS, allowing a local attacker to cause memory corrupt...

CVE-2011-4110

CVE-2011-4110 is a vulnerability in the Linux kernel 2.6 that affects the user_update function in security/keys/user_defined.c. The issue allows local users to trigger a denial of service via a NULL pointer dereference and kernel oops when updating a negative key into a fully instantiated key. Ex...

CVE-2012-6638

CVE-2012-6638 (Linux kernel) affects the tcp_rcv_state_process in net/ipv4/tcp_input.c and can cause a DoS due to a flood of SYN+FIN packets. The vulnerability exists in kernels before 3.2.24 and is fixed in the 3.2.24 update (per ChangeLog-3.2.24). Exploitation is described as remote and results...

CVE-2013-7281

CVE-2013-7281 affects the Linux kernel’s dgram_recvmsg in net/ieee802154/dgram.c and allows local users to leak kernel stack memory by updating a length value without initializing an associated data structure. The issue is fixed in kernel 3.12.4 (patch referenced in changelog), with exposure via ...

CVE-2016-5344

CVE-2016-5344 affects the MDSS driver in the Linux kernel 3.x, used in Qualcomm QuIC Android MSM contributions. The root cause is multiple integer overflows triggered by large size values in mdss_compat_utils.c, mdss_fb.c, and mdss_rotator.c, potentially causing denial of service and possibly oth...

CVE-2017-15951

The CVE-2017-15951 issue affects the Linux kernel KEYS subsystem prior to 4.13.10. A race condition occurs because updates and negative-state key lookups are not properly synchronized, enabling a local user to trigger a denial of service and possibly other unspecified impacts via crafted system c...

CVE-2017-16650

CVE-2017-16650 affects the Linux kernel’s qmi_wwan_bind in drivers/net/usb/qmi_wwan.c (through kernel 4.13.11). A crafted USB device can be used by a local attacker to trigger a divide-by-zero, causing a denial of service (system crash) and potentially other impact. The vulnerability is locally e...

CVE-2017-2634

CVE-2017-2634 affects the Linux kernel DCCP implementation prior to 2.6.22.17, where the IPv4-only inet_sk_rebuild_header() function was used for both IPv4 and IPv6 DCCP connections. This can result in memory corruptions and allows a remote attacker to crash the system. Connected advisories confi...

CVE-2019-15793

CVE-2019-15793 concerns a shiftfs issue in Ubuntu’s patched Linux kernel (5.0/5.3). The bug translated user/group IDs to init_user_ns instead of the lower filesystem’s s_user_ns, risking bypass of discretionary access control. Consequence: local attacker could exploit the mis-translation to acces...

CVE-2021-47074

In CVE-2021-47074, the Linux kernel nvme-loop module had a memory leak in nvme_loop_create_ctrl(): if nvme_init_ctrl() fails, the created loop ctrl must be freed before exiting. The fix ensures proper cleanup of the loop ctrl on error to avoid leaking memory. The vulnerability’s described impact ...

CVE-2021-47559

CVE-2021-47559 concerns a NULL pointer dereference in the Linux kernel’s net/smc path, specifically in smc_vlan_by_tcpsk(). The issue could lead to a NULL dereference when iterating lower devices and calling is_vlan_dev, potentially impacting availability. The advisory notes that the manual lower...

CVE-2021-47598

CVE-2021-47598 affects the Linux kernel (net/sched/sch_cake) where calling cake_destroy() from cake_init() during qdisc creation could trigger use-after-free in the cake/qdisc destroy path. The issue manifests when a qdisc invokes its own destroy() method during initialization, conflicting with t...

CVE-2022-48637

CVE-2022-48637 — bnxt skb UAF in Linux kernel : The bnxt driver hands over a completed skb to the PTP worker (bnxt_tx_int). If the worker runs before the remaining code, the skb may be freed while still in use. The fix makes the loss of ownership explicit by setting the skb pointer to NULL, notin...

CVE-2022-48659

CVE-2022-48659 is a Linux kernel issue localized to mm/slub where kmalloc() can fail with an OOM, and the fix ensures create_unique_id() returns a proper errno instead of triggering BUG_ON(). The result is a kernel BUG at mm/slub.c:5893 in the failing path, with the stack showing sysfs_slab_add →...

CVE-2022-48921

Summary of CVE-2022-48921 : In the Linux kernel, a race between sched_post_fork() and setpriority(PRIO_PGRP) for a thread group can trigger a NULL pointer dereference in reweight_entity() (part of CFS). The scenario: a main process spawns multiple new threads that then call setpriority, while sch...

CVE-2022-49147

Technical details for CVE-2022-49147 are not publicly provided in the supplied documents; no affected products, impact, or remediation are specified here. Monitor for updates from connected sources.

CVE-2022-49313

CVE-2022-49313 : Linux kernel patch fixes a deadlock in usb host oxu_bus_suspend(). The issue arises when oxu_bus_suspend() holds oxu->lock while waiting for a timer to stop via del_timer_sync(), but the timer handler also needs the same lock, causing a potential deadlock. The patch removes de...

CVE-2022-49325

CVE-2022-49325 affects the Linux kernel’s TCP path, specifically the snd_cwnd field. The advisory notes historical bugs where tp->snd_cwnd could be zero or otherwise illegal, and that syzbot WARN_ON_ONCE(!tp->prior_cwnd) could trigger. The fix introduces accessors to read/set tp->snd_cwn...

CVE-2022-49721

CVE-2022-49721 affects the Linux kernel (arm64) ftrace. The root cause is inconsistent handling of PLT entries when calling ftrace trampolines: ftrace_modify_call() can produce out-of-range branches, causing warnings and no code change, or replace the old branch with a BRK, risking a kernel panic...

CVE-2023-33250

CVE-2023-33250 affects the Linux kernel 6.3, with a use-after-free in the iommufd IO page table path: iopt_unmap_iova_range (drivers/iommu/iommufd/io_pagetable.c). The root cause is use-after-free, leading to a potential availability impact. The NVD/CVE entry lists a MEDIUM base score (4.4) via C...

CVE-2023-38432

CVE-2023-38432 affects the Linux kernel prior to 6.3.10. The KSMBD SMB2 server (fs/smb/server/smb2misc.c) does not validate the relationship between the SMB command payload size and RFC1002 length, causing an out-of-bounds read. Impact: potential information disclosure or crash as stated by affec...

CVE-2023-50431

CVE-2023-50431 concerns the Linux kernel driver path sec_attest_info in drivers/accel/habanalabs/common/habanalabs_ioctl.c, where info->pad0 is not initialized, allowing an information leak to user space. The vulnerability affects the Linux kernel up to versions around 6.6.5 (per the provided ...

CVE-2023-52518

Astra Linux security bulletin confirms CVE-2023-52518 affecting the Linux kernel Bluetooth stack: hci_codec: Fix leaking content of local_codecs. The vulnerability arises when codecs are stored in the local_codecs list and elements aren’t freed, causing a memory leak. The bulletin notes a patch t...

CVE-2023-52566

The CVE concerns NILFS2 in Linux kernels: in nilfs_gccache_submit_read_data(), releasing the buffer head (bh) before unlocking/putting its page can trigger a use-after-free if bh->b_page is dereferenced. The fix moves the release after unlocking and putting the page. This patch targets GC-rela...

CVE-2023-52569

CVE-2023-52569 affects the Linux kernel's btrfs code path. The patch removes a BUG() on failure to insert a delayed dir index item and adds proper error handling, but it does not fix the underlying issue of using the same index number for different items, per the provided documentation. No exploi...

CVE-2023-52778

CVE-2023-52778 affects the Linux kernel’s MPTCP implementation. The root cause is a commit that allowed TCP sockets and MPTCP subflows to build egress packets larger than 64K, exceeding the DSS data size and causing misrepresentation on the wire and stream corruption. The issue manifests as large...

CVE-2023-52931

CVE-2023-52931 : In the Linux kernel, a vulnerability in the DRM/i915 stack (vm use-after-free) was resolved. The root cause was that adding the vm to the vm_xa table made it visible to userspace, creating a race with the kernel when closing the vm. The remediation is to take an extra reference b...

CVE-2023-52974

CVE-2023-52974: Linux kernel scsi: iscsi_tcp fix UAF during login when accessing the shost ipaddress. If iscsi_sw_tcp_session_create() fails and userspace reads the host ipaddress during session teardown, a use-after-free occurs. The fix delays freeing by setting tcp_sw_host->session only afte...

CVE-2023-53014

The CVE-2023-53014 issue affects the Linux kernel’s DMA engine (tegra). It describes a memory leak that occurs when terminating an ongoing transfer: the vdesc must be terminated and placed in the desc_terminated list, with the descriptor freed later in desc_free_list(). The provided connected doc...

CVE-2023-53078

CVE-2023-53078 is a Linux kernel memleak in the SCSI ALUA path (scsi_dh_alua: alua_activate). The issue occurs if alua_rtpg_queue() fails during alua_activate(), leaving the allocated qdata unreleased and causing a memory leak. The public docs indicate the fix is to free qdata in the error path. ...

CVE-2023-53084

CVE-2023-53084 – Linux kernel (drm/shmem) 손상 문제 확인 Impact: In the Linux kernel, the error path in drm_gem_shmem_mmap() could fail to drop a reference, causing a dma-buf shmem GEM object to be freed prematurely and potentially leading to a use-after-free. Affected component: drm/shmem-helper and r...

CVE-2023-53097

CVE-2023-53097: In the Linux kernel powerpc IOMMU path, a memory leak occurs when using debugfs_lookup() because the result isn’t dput()-ed; the fix uses debugfs_lookup_and_remove() to handle the lookup and release in one step. The vulnerability is described as local, with potential high impact t...

CVE-2023-53113

The CVE-2023-53113 entry concerns the Linux kernel wifi NL80211 offchannel check. A NULL-pointer dereference could occur when a link was created by userspace in AP mode but not activated yet, resulting in a chandef that is invalid or has no channel. The vulnerability arises from dereferencing thi...

CVE-2024-24860

CVE-2024-24860 : A race condition in the Linux kernel Bluetooth device driver, in the functions {min,max}_key_size_set(), can cause a NULL pointer dereference and potentially kernel panic or denial of service. Affected component: Linux kernel Bluetooth subsystem. Exploitation status and remediati...

CVE-2024-26657

CVE-2024-26657 relates to a NULL pointer dereference in the Linux kernel’s DRM scheduler code (drm_sched_entity_init). The issue could be triggered by AMDGPU user-space IOCTL flow: user calls AMDGPU_CTX_ALLOC_CTX via amdgpu_ctx_ioctl, then AMDGPU_WAIT_CS without submitting a job, which could lead...

CVE-2024-26896

CVE-2024-26896 refers to a memory-leak issue in the Linux kernel wifi driver (wfx) when starting an AP. The root cause, as described in the sources, is that memory allocated by ieee80211_beacon_get() is never released, leading to kmemleak-reported unreferenced objects and potential memory exhaust...

CVE-2024-27402

CVE-2024-27402 affects the Linux kernel’s phonet/pep path. The description states a race in skb_queue_empty() is mishandled: receive queues are protected by their spin-locks, not the socket lock, which can cause skb_peek() to return NULL or a pointer to a socket buffer that has already been deque...

CVE-2024-36479

Technical details about CVE-2024-36479 are not provided in the connected documents. Public information in the initial description is high level. Monitor for updates and additional details from vendor/maintainer advisories.

CVE-2024-36914

CVE-2024-36914 refers to a Linux kernel issue in drm/amd/display: writeback paths were incorrectly handled for DRM_MODE_CONNECTOR_WRITEBACK, causing KASAN slab-out-of-bounds messages. The root cause is a dynamic memory safety error detector triggering when writeback connectors do not initialize c...

CVE-2024-38578

The CVE-2024-38578 issue is a Linux kernel vulnerability in ecryptfs: the buffer for the TAG 66 packet was 3 bytes too small, causing a potential write past the end (KASAN slab-out-of-bounds). The fix increases the allocation size to ensure the entire packet fits, addressing the bug described in ...

CVE-2024-39475

The CVE-2024-39475 issue affects the Linux kernel framebuffer driver (fbdev) for savagefb: a patch prevents divide-by-zero by validating pixclock in savagefb_check_var, and savagefb_probe now handles the error return. The vulnerability arises when pixclock is 0, potentially causing a divide-by-ze...

CVE-2024-40975

CVE-2024-40975 affects the Linux kernel in platform/x86/x86-android-tablets code. The issue arises when a device is unregistered while consumers still hold references, with the regulator subsystem given as a concrete example. If a regulator is unregistered prematurely, a WARN() can be triggered (...