CVE-2025-22050

The CVE-2025-22050 entry concerns the Linux kernel USB networking path. A race between usb_submit_urb and __usbnet_queue_skb occurs due to a missing usbnet_going_away check in usb_submit_urb, while __usbnet_queue_skb performs this validation. This can let a URB proceed while the corresponding SKB...

CVE-2025-22120

CVE-2025-22120 affects the Linux kernel ext4: in ext4_setattr(), a jump to the right label out_mmap_sem may occur. If ext4_inode_attach_jinode() fails, filemap_invalidate_unlock() may not be called to unlock mapping->invalidate_lock, leading to a hung task (as shown by the given EXT4-fs error ...

CVE-2025-37780

CVE-2025-37780 — Linux kernel isofs slab-out-of-bounds . The vulnerability occurs in isofs_fh_to_parent when a too-small fid is used: 12 bytes allocated for file_handle->f_handle while accessing parent_block requires at least 16 bytes, causing a potentially dangerous read. The issue was observ...

CVE-2025-37932

The CVE-2025-37932 issue affects the Linux kernel’s HTB qdisc: htb_qlen_notify() was not idempotent and could deactivate an HTB class or trigger a warning if called when already deactivated. The fix ports the function to be idempotent, easing callers such as fq_codel_dequeue() and qdisc_tree_redu...

CVE-2025-38117

Summary: CVE-2025-38117 affects the Linux kernel Bluetooth MGMT path, specifically the mgmt_pending list. The root cause is a concurrency issue where the list access could lead to a slab-use-after-free in hci_sock_get_channel, triggering a crash under KASAN reports. The vulnerability is mitigated...

CVE-2025-38349

The CVE-2025-38349 entry concerns a Linux kernel eventpoll use-after-free risk due to dropping the epoll refcount while the ep mutex is still held. Description and related details explain that incrementing/decrementing the ep refcount in the wrong order combined with unlock timing can allow a con...

CVE-2009-0675

CVE-2009-0675 affects the Linux kernel up to version 2.6.28.6, where the skfp_ioctl function in drivers/net/skfp/skfddi.c incorrectly allows SKFP_CLR_STATS requests when CAP_NET_ADMIN is absent rather than present, enabling local users to reset driver statistics (inverted logic). The vulnerabilit...

CVE-2009-1336

CVE-2009-1336 affects the Linux kernel (before 2.6.23) in the NFS client path. The issue is that a structure member that stores the maximum NFS filename length is not properly initialized, related to the encode_lookup function. This allows local users to trigger a denial of service (OOPS) by usin...

CVE-2009-1630

CVE-2009-1630 affects the Linux kernel nfs client: the nfs_permission function in fs/nfs/dir.c (kernel 2.6.29.3 and earlier) does not check execute (MAY_EXEC) permission bits when atomic_open is available. This allows local users to bypass permissions and execute files, as demonstrated by files o...

CVE-2009-4020

CVE-2009-4020 describes a stack-based buffer overflow in the Linux kernel 2.6.32 hfs subsystem (fs/hfs/dir.c, hfs_readdir). A crafted Hierarchical File System (HFS) filesystem could allow an attacker to achieve an unspecified impact via the HFS filesystem. Several Nessus/GD advisories link this C...

CVE-2010-3875

CVE-2010-3875 affects the Linux kernel, specifically the ax25_getname function in net/ax25/af_ax25.c. The root cause is that a structure is not initialized, enabling local users to read a copy of kernel stack memory and potentially obtain sensitive information. The issue is tied to kernels prior ...

CVE-2010-4346

The vulnerability CVE-2010-4346 affects the Linux kernel: install_special_mapping in mm/mmap.c before 2.6.37-rc6 does not call security_file_mmap as expected, allowing local users to bypass mmap_min_addr restrictions and potentially trigger NULL pointer dereference via a crafted assembly-language...

CVE-2010-4526

CVE-2010-4526 describes a race condition in the Linux kernel between 2.6.11-rc2 and 2.6.33 in sctp_icmp_proto_unreachable (net/sctp/input.c). An ICMP Unreachable to a socket that is already locked by a user can free the socket and trigger list corruption via sctp_wait_for_connect, enabling remote...

CVE-2011-1017

CVE-2011-1017 relates to a heap-based buffer overflow in the Linux kernel’s LDM code path. Affected component: fs/partitions/ldm.c (ldm_frag_add) in kernel 2.6.37.2 and earlier. Root cause cited in connected docs: bugs in evaluating LDM partitions could crash the kernel for certain corrupted LDM ...

CVE-2011-1162

CVE-2011-1162 is a memory-clearing flaw in the Linux kernel 2.6 tpm_read() that can let a local unprivileged user read data from a previous TPM command. The connected advisories (MiracleLinux AXSA entries, Oracle Linux ELSA advisories, and RHSA-2012:0010) explicitly list CVE-2011-1162 among kerne...

CVE-2014-3647

CVE-2014-3647 affects the Linux kernel KVM emulation path: arch/x86/kvm/emulate.c. The root cause is improper handling of RIP changes during instruction emulation, enabling a local guest OS user to crash the guest (DoS) with a crafted application in kernels up to 3.17.2. The provided connected do...

CVE-2014-4656

CVE-2014-4656 affects the Linux kernel ALSA sound control (sound/core/control.c). The vulnerability arises from multiple integer overflows in ALSA control handling, exploitable by local users via /dev/snd/controlCX to cause a denial of service. The issue is tied to (1) index values in snd_ctl_add...

CVE-2014-9420

CVE-2014-9420 affects the Linux kernel iso9660 isofs rock.c: rock_continue does not bound the number of Rock Ridge continuation entries, allowing a local attacker crafting an ISO image to trigger an infinite loop and cause DoS (system hang/crash) on kernels up to 3.18.1. Public advisories from Ce...

CVE-2014-9644

CVE-2014-9644 affects the Linux kernel Crypto API prior to 3.18.5. It allows a local user to load arbitrary kernel modules by abusing a bind() call on an AF_ALG socket with a module template expression (eg, vfat(aes)) in salg_name. This is a local, privilege-related issue, separate from CVE-2013-...

CVE-2017-15951

The CVE-2017-15951 issue affects the Linux kernel KEYS subsystem prior to 4.13.10. A race condition occurs because updates and negative-state key lookups are not properly synchronized, enabling a local user to trigger a denial of service and possibly other unspecified impacts via crafted system c...

CVE-2021-46283

CVE-2021-46283 affects the Linux kernel’s nf_tables_newset in nf_tables_api.c, where missing initialization of nft_set_elem_expr_alloc can trigger a NULL pointer dereference/GPF when a local user creates a netfilter table expression in their namespace, leading to a denial of service. The vulnerab...

CVE-2022-48905

CVE-2022-48905 relates to a memory leak in the Linux kernel's ibmvnic driver during flushing of the reset-work-item. The issue is resolved by fixing the tiny memory leak in the reset work queue, as noted in the public description and repeated across connected advisories (Astra Linux and Nessus/Un...

CVE-2022-48921

Summary of CVE-2022-48921 : In the Linux kernel, a race between sched_post_fork() and setpriority(PRIO_PGRP) for a thread group can trigger a NULL pointer dereference in reweight_entity() (part of CFS). The scenario: a main process spawns multiple new threads that then call setpriority, while sch...

CVE-2022-49190

CVE-2022-49190 affects the Linux kernel (kernel/resource). Root cause: boot memory allocated via alloc_resource() may be leaked if callers use kfree directly, causing a kernel BUG; remediation leaks only a few bytes to avoid patching every call site. A fix was applied in the kernel (commit ebff7d...

CVE-2022-49229

CVE-2022-49229 affects the Linux kernel: when unregistering a physical PTP clock that has attached virtual clocks, the kernel now unregisters the virtual clocks as well to prevent a fault. The issue could trigger a page fault in ptp_vclock_read and lead to an OOPs trace, as shown in the provided ...

CVE-2022-49263

The CVE-2022-49263 case concerns a Linux kernel flaw in the brcmfmac: pcie path. The vulnerability is described as a memory-leak in the error path of brcmf_pcie_setup where firmware release occurs after brcmf_chip_get_raminfo fails; the CLM blob is released in the device remove path. Connected ad...

CVE-2022-49306

CVE-2022-49306 affects the Linux kernel USB subsystem (usb: dwc3: host). The issue arises from stop setting the ACPI companion for the DWC3 host; the sysdev pointer is now used when assigning ACPI companions to xHCI ports and USB devices. Assigning the ACPI companion previously could replace the ...

CVE-2022-49559

CVE-2022-49559 (Linux kernel, KVM/x86) is resolved. The issue involved dropping WARNs that incorrectly assumed KVM cannot let a triple fault (KVM_REQ_TRIPLE_FAULT) escape from L2 to L1. The vulnerability could be triggered when userspace injects a machine check while L2 is active with CR4.MCE=0, ...

CVE-2022-49606

CVE-2022-49606 affects the Linux kernel RDMA/irdma path. The issue is a sleep (mutex) operation taken to process RoCEv2 QPs on netdev events, which can trigger a BUG: sleeping function called from invalid context in mutex_lock and lead to a kernel crash. The fix removes RoCEv2 handling in irdma_c...

CVE-2022-49903

CVE-2022-49903 affects the Linux kernel IPv6 routing: during ip6_route_net_init_late(), if the files ipv6_route or rt6_stats fail to be created, initialization may complete and later removing the proc entries could trigger a WARNING about the missing rt6_stats. The issue is a local-privilege-cont...

CVE-2023-20842

CVE-2023-20842 affects MediaTek devices via the core component described as /imgs y s_cmdq/ . The vulnerability is an out-of-bounds write caused by missing valid range checking in imgsys_cmdq, which can enable local privilege escalation with System execution privileges after user interaction. No ...

CVE-2023-32252

CVE-2023-32252 affects the Linux kernel ksmbd (the in-kernel SMB server). The flaw occurs in the handling of SMB2_LOGOFF commands due to improper validation of a pointer before access. This can allow an attacker to trigger a denial-of-service on the affected system. The description and connected ...

CVE-2023-33250

CVE-2023-33250 affects the Linux kernel 6.3, with a use-after-free in the iommufd IO page table path: iopt_unmap_iova_range (drivers/iommu/iommufd/io_pagetable.c). The root cause is use-after-free, leading to a potential availability impact. The NVD/CVE entry lists a MEDIUM base score (4.4) via C...

CVE-2023-52484

CVE-2023-52484 affects the Linux kernel in iommu/arm-smmu-v3 where arm_smmu_mm_invalidate_range (renamed to arm_smmu_mm_arch_invalidate_secondary_tlbs since 6.6-rc1) can trigger a soft lockup during SVA-case TLBI range notifs. The issue is linked to not checking MAX_TLBI_OPS and near MMU tlb flus...

CVE-2023-53016

CVE-2023-53016 concerns a potential deadlock in the Linux kernel Bluetooth rfcomm path. The issue arises when rfcomm_sock_connect holds the sk lock while waiting for the rfcomm lock, and rfcomm_sock_release may hold the rfcomm lock and attempt to acquire the sk lock, creating a deadlock scenario....

CVE-2023-53017

The CVE-2023-53017 entry concerns a memory leak in the Linux kernel Bluetooth stack (hci_sync path). Root cause: in hci_update_adv_data(), if hci_cmd_sync_queue() fails, the allocated inst_ptr was not freed. Mitigation: switch to using ERR_PTR/PTR_ERR to pass the instance to the callback, so no a...

CVE-2023-53097

CVE-2023-53097: In the Linux kernel powerpc IOMMU path, a memory leak occurs when using debugfs_lookup() because the result isn’t dput()-ed; the fix uses debugfs_lookup_and_remove() to handle the lookup and release in one step. The vulnerability is described as local, with potential high impact t...

CVE-2024-26888

CVE-2024-26888 : Linux kernel vulnerability in Bluetooth msft path reported as fixed by a memory leak fix. The issue involved a leaking buffer allocated to send MSFT_OP_LE_MONITOR_ADVERTISEMENT. Public docs confirm the fix; CVSS indicates LOCAL attack vector with low to moderate impact (Base 5.5,...

CVE-2024-35998

CVE-2024-35998 – Linux kernel SMB3 deadlock fix Root cause: In cifs_sync_mid_result, incorrect lock ordering could cause a thread deadlock (ORDER_REVERSAL) where TCP_Server_Info.srv_lock is acquired while TCP_Server_Info.mid_lock is held. Impact: Deadlock potential in the SMB/CIFS path (smb3) wit...

CVE-2024-35999

CVE-2024-35999 concerns the Linux kernel where a data race could occur in the SMB3 path due to a missing lock when picking the channel. Coverity identified a missing channel lock when accessing the ses channel index (Address-Coverity: 1582039). The vulnerability was resolved in the Linux kernel a...

CVE-2024-36479

Technical details about CVE-2024-36479 are not provided in the connected documents. Public information in the initial description is high level. Monitor for updates and additional details from vendor/maintainer advisories.

CVE-2024-38578

The CVE-2024-38578 issue is a Linux kernel vulnerability in ecryptfs: the buffer for the TAG 66 packet was 3 bytes too small, causing a potential write past the end (KASAN slab-out-of-bounds). The fix increases the allocation size to ensure the entire packet fits, addressing the bug described in ...

CVE-2024-40990

CVE-2024-40990 relates to the Linux kernel RDMA mlx5 subsystem where the srq max_sge attribute, provided by the user, was inserted/used without proper validation. The issue is resolved by adding a check to ensure max_sge does not exceed the maximum allowed before use. Affects the mlx5 SRQ handlin...

CVE-2024-42106

CVE-2024-42106 : In the Linux kernel, the inet_diag path for raw sockets could read an uninitialized pad field in inet_diag_req_v2 when converting inet_diag_req to v2, leading to uninitialized reads in raw_lookup(). The root cause is that inet_diag_get_exact_compat() and inet_diag_dump_compat() d...

CVE-2024-42241

The CVE-2024-42241 issue affects the Linux kernel’s PMD-sized page cache in shmem files. When the HPAGE_PMD_ORDER exceeds MAX_PAGECACHE_ORDER, PMD-sized page caches may not be supported by xarray, leading to errors like xas_split_alloc, split_huge_page_to_list_to_order, and related fallocate/shme...

CVE-2024-42318

CVE-2024-42318: In the Linux kernel, Landlock loses track of its restrictions when cred are replaced due to missing cred_transfer hook. The special case KEYCTL_SESSION_TO_PARENT uses cred_transfer, while Landlock implements only cred_prepare, causing Landlock restrictions to be dropped and enabli...

CVE-2024-43861

CVE-2024-43861 affects the Linux kernel (net/usb/qmi_wwan) where a memory leak could occur for non-IP packets due to an unused skb not being freed. The description in Connected documents confirms the fix: freeing the unused skb when non-IP packets arrive. The CIRCL/CVE sighting shows related advi...

CVE-2024-43880

CVE-2024-43880 affects the Linux kernel mlxsw spectrum ACL (Spectrum-2 and newer). The vulnerability arises from how ACLs could be migrated between A-TCAM and C-TCAM using the objagg mask aggregation, where the driver and lib compared masks without respecting TCAM context, potentially creating ne...

CVE-2024-45019

CVE-2024-45019 affects the Linux kernel net/mlx5e component. The vulnerability stems from incorrect locking during the tx_timeout reporter: mlx5e_safe_reopen_channels() requires the state lock, but a prior Fixes change removed it to fix another issue. The referenced patch restores the required st...

CVE-2024-46804

CVE-2024-46804 affects the Linux kernel’s DRM/AMD display path, specifically HDCP DDC access. The vulnerability stems from an array index overrun due to not validating the index, which could lead to overrun/W earlier reports. The fix adds proper checks: validate the message id (msg_id) and ensure...