CVE-2024-49890

CVE-2024-49890 : Linux kernel fix for a NULL dereference in drm/amd/pm by ensuring fw_info is not NULL before use. The issue manifested as a null dereference warning reported by Coverity; the patch prevents dereferencing a NULL fw_info and thus mitigates the vulnerability as described in the entr...

CVE-2024-49988

The CVE-2024-49988 issue concerns the ksmbd kernel SMB server: during an oplock break, opinfo->conn could be used after ksmbd_conn is freed in multichannel scenarios. The fix adds a reference count to ksmbd_conn to ensure it is not freed while still in use. This is a Linux kernel-level vulnera...

CVE-2024-50185

The CVE-2024-50185 entry concerns the Linux kernel mptcp subsystem, where a bug in peer implementations could send corrupted DSS options, triggering warnings in the data path. The issue is addressed by making mptcp handle DSS corruption more consistently, including assertion-based protections and...

CVE-2024-53188

Technical details for CVE-2024-53188 are not publicly available in the provided documents. No vendor/model/version specifics or fixes are cited beyond the patch description. Monitor for updates from upstream advisories and vendor notices.

CVE-2024-53201

Technical details about CVE-2024-53201 are not provided in the supplied documents. No affected products, root cause, impact, or remediation details are included here; monitor for official disclosures.

CVE-2024-54193

Technical details about CVE-2024-54193 are not publicly provided in the connected documents. The initial description summarizes a kernel fix but does not specify affected subcomponents, root cause, impact, or patch specifics.

CVE-2024-56622

Summary: CVE-2024-56622 is a Linux kernel vulnerability in the SCSI UFS core sysfs path that can trigger a division by zero when monitoring is disabled. The issue is tracked across multiple vendors/distros with fixed releases: Debian LTS advisory DLA-4076-1 notes a fix in linux-6.1-6.1.6.1.128-1~...

CVE-2024-58079

CVE-2024-58079 is a Linux kernel vulnerability involving the media/uvcvideo subsystem. The issue arises from using the wrong device for device-managed cleanup when unbinding a driver with a GPIO unit in use; cleanup functions can be skipped, leaving an IRQ enabled and potentially accessing freed ...

CVE-2025-21729

The CVE-2025-21729 vulnerability affects the Linux kernel wifi driver rtw89 (rtwdev) with a race between cancel_hw_scan and hw_scan completion. Root cause: rtwdev->scanning was not mutex-protected, allowing cancel_hw_scan to observe/modify state while hw_scan completion could unset the flag an...

CVE-2025-21738

CVE-2025-21738 describes a Linux kernel vulnerability in the ata libata-sff path where ata_pio_sector() could write outside the allocated buffer, potentially corrupting memory. The issue arises when handling a SCSI_IOCTL_SEND_COMMAND (out_len 0xd42) with SCSI command ATA_16 PASS-THROUGH, ATA_NOP,...

CVE-2025-21792

CVE-2025-21792 is a Linux kernel issue affecting AX25 binding via SO_BINDTODEVICE or ax25_bind, where refcount leaks occur in ax25_release due to improper refcount handling. The root cause is that when a device is bound to a socket, refcounts must already be incremented for the bound device, but ...

CVE-2025-21924

CVE-2025-21924 : In the Linux kernel, during ptp initialization for the hns3 driver, hclge_ptp_get_cycle may fail and previously not unregister/free the clock. The fix calls hclge_ptp_destroy_clock to unregister and free the clock when hclge_ptp_get_cycle fails, mitigating potential resource leaks.

CVE-2025-22106

CVE-2025-22106 affects the Linux kernel vmxnet3 driver. The root cause was that vmxnet3 did not unregister xdp_rxq_info in vmxnet3_reset_work(), because vmxnet3_rq_destroy() was not invoked in that path. The fix moves the unregister code from vmxnet3_rq_destroy() to vmxnet3_rq_cleanup(), preventi...

CVE-2025-22118

Linux kernel vulnerability CVE-2025-22118 affects the ice driver where queue quanta parameters could lead to out-of-bounds access. The fix adds queue wraparound prevention in quanta configuration and ensures end_qid cannot overflow by validating start_qid and num_queues. This is a local-privilege...

CVE-2025-23155

The CVE-2025-23155 issue affects the Linux kernel’s STMicroelectronics stmmac driver. In stmmac_request_irq_multi_msi(), a pointer to the stack variable cpu_mask is passed to irq_set_affinity_hint(), which is stored in irq_desc->affinity_hint. After the function returns, the pointer becomes da...

CVE-2025-37801

Summary: CVE-2025-37801 affects the Linux kernel driver for SPI on i.MX cores. The root cause is that after spi_imx_setupxfer() returns an error, spi_imx->rx and spi_imx->tx function pointers may be NULL, leading to a NULL pointer dereference during SPI transfers (spi_imx_pio_transfer , etc...

CVE-2025-37815

CVE-2025-37815 concerns the Linux kernel’s misc: microchip: pci1xxxx IRQ handling. The patch fixes a kernel panic during IRQ handler registration by acquiring the spinlock and saving the current interrupt state before processing the IRQ via generic_handle_irq. A previous fix substituted generic_h...

CVE-2025-37817

Linux kernel vulnerability CVE-2025-37817 involves a double free in the mcb path: in chameleon_parse_gdd(), if mcb_device_register() fails, the code could release mdev via put_device() and then free it again on the error path. The fixed behavior is to return early if mcb_device_register() fails, ...

CVE-2025-37873

The CVE-2025-37873 entry concerns the Linux kernel Ethernet driver for Broadcom/BNXT (eth: bnxt). The issue arises in the Tx path after a conversion to a free-running tx_prod, where masking on the Tx error path was missed, causing a crash on error conditions such as DMA mapping failures. The root...

CVE-2025-37879

CVE-2025-37879 affects the Linux kernel 9p/net component. Root cause: in p9_client_write() and p9_client_read_once(), a server could reply with success but a negative count due to signed variable handling, leading to incorrect conclusions about written/read data. The documented fix is to convert ...

CVE-2025-37958

CVE-2025-37958 affects the Linux kernel THP path. The issue arises when migrating a THP: concurrent access to the PMD migration entry during a deferred split scan could dereference an invalid address. The fix adds a check of the PMD migration entry and returns early, since the PMD migration entry...

CVE-2025-38279

CVE-2025-38279: Linux kernel bpf verifier backtracking bug in __mark_chain_precision (verifier) when handling precise registers; a test demonstrating a r10-related path and a patch that stops including stack ptr in precision backtracking was provided. Affected component: Linux kernel BPF verifier...

CVE-2025-38653

CVE-2025-38653: In the Linux kernel, the vulnerability stems from checking proc_lseek directly via pde->proc_ops->proc_lseek, which can cause a use-after-free in a module removal (rmmod) scenario. The issue is a gap in proc_reg_open() that was later addressed by applying the same mitigation...

CVE-2010-3859

CVE-2010-3859 stems from multiple signedness errors in the Linux kernel’s TIPC implementation, allowing local privilege escalation via a crafted sendmsg that triggers a heap-based buffer overflow in tipc_msg_build and related iovec handling (verify_iovec). Public sources confirm affected historic...

CVE-2013-4348

CVE-2013-4348 affects the Linux kernel (up to 3.12) via skb_flow_dissect in net/core/flow_dissector.c. A crafted small IHL value in IPIP-encapsulated packets can trigger an infinite loop, enabling remote denial of service. The connected Nessus advisories reproduce the same description for Unity L...

CVE-2014-0205

CVE-2014-0205 affects the Linux kernel futex_wait in kernel/futex.c, where a reference-count during requeue isn’t properly maintained before 2.6.37. This enables local users to cause denial of service (use-after-free and system crash) and, in a crafted scenario, potentially gain privileges by tri...

CVE-2015-8709

CVE-2015-8709 affects the Linux kernel, specifically the code path in kernel/ptrace.c up to version 4.4.1. The issue arises from how uid and gid mappings are handled when establishing a user namespace, allowing a local user to gain privileges by waiting for a root process to enter that namespace ...

CVE-2016-3136

CVE-2016-3136 affects the Linux kernel up to version 4.5.0, where the mct_u232_msr_to_state function in drivers/usb/serial/mct_u232.c can be triggered by a crafted USB device without two interrupt-in endpoint descriptors. This allows physically proximate attackers to cause a denial of service (NU...

CVE-2017-11472

CVE-2017-11472 affects the Linux kernel via the acpi_ns_terminate() path in drivers/acpi/acpica/nsutils.c. The flaw does not flush the operand cache, enabling a local user to dump kernel memory and bypass KASLR by crafting an ACPI table, with impact described for kernels before 4.12 (and through ...

CVE-2017-16643

CVE-2017-16643 affects the Linux kernel, specifically the parse_hid_report_descriptor function in drivers/input/tablet/gtco.c, with exploitation possible via a crafted USB device. It allows a local user to trigger an out-of-bounds read and system crash (DoS) and potentially other impacts. The iss...

CVE-2022-49280

Summary of CVE-2022-49280 (Linux kernel) : Affected component is NFSD in the Linux kernel, specifically nfssvc_decode_writeargs(). The root cause was an underflow risk from treating a length as signed, allowing an issue where args->len had no lower bound. The fix implemented across sources is ...

CVE-2022-49413

CVE-2022-49413 affects the Linux kernel bfq driver (bfq_merge_bio). The vulnerability arises when a process migrates to a different cgroup or writeback starts bios for another cgroup, leaving stale cgroup data in bfq’s bic and potentially merging requests across distinct or dead bfq queues, riski...

CVE-2023-1583

CVE-2023-1583 : A NULL pointer dereference in io_uring/filetable.c (io_file_bitmap_get) can be triggered after unregistration of fixed files when IORING_FILE_INDEX_ALLOC is used. The root cause is that context data (file_alloc_start/end and alloc_hint) is not cleared, allowing an unprivileged loc...

CVE-2023-31082

CVE-2023-31082 : In Linux kernel 6.2, the issue arises from a sleeping function invoked from an invalid context in gsmld_write (drivers/tty/n_gsm.c), which can block the kernel. The vulnerability is explicitly tied to the affected component and context, with the impact described as potentially ca...

CVE-2023-3220

CVE-2023-3220 affects the Linux kernel (through 6.1-rc8) in the MSM DPU path: dpu_crtc_atomic_check in drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c does not validate kzalloc() return, causing a NULL pointer dereference. Impact is local attacker could crash the system; no remote code execution indicat...

CVE-2023-32248

CVE-2023-32248 describes a flaw in the Linux kernel’s ksmbd (the in-kernel SMB server) related to the handling of SMB2_TREE_CONNECT and SMB2_QUERY_INFO. The issue stems from the lack of proper validation of a pointer before access, which attackers can leverage to cause a denial-of-service conditi...

CVE-2023-52481

In the Linux kernel, the following vulnerability has been resolved: arm64: errata: Add Cortex-A520 speculative unprivileged load workaround Implement the workaround for ARM Cortex-A520 erratum 2966298. On anaffected Cortex-A520 core, a speculatively executed unprivileged loadmight leak data from ...

CVE-2023-52566

A use-after-free vulnerability exists in the nilfs2 component of the Linux kernel within the nilfs_gccache_submit_read_data() function. The issue occurs because brelse(bh) is called to drop the reference count of bh when nilfs_dat_translate() fails; if the count hits zero and the owner page is un...

CVE-2023-52778

CVE-2023-52778 affects the Linux kernel’s MPTCP implementation. The root cause is a commit that allowed TCP sockets and MPTCP subflows to build egress packets larger than 64K, exceeding the DSS data size and causing misrepresentation on the wire and stream corruption. The issue manifests as large...

CVE-2023-52868

CVE-2023-52868 is a Linux kernel vulnerability in the thermal: core component that can cause a string overflow. The root cause is that the dev->id value is derived from ida_alloc() and can be up to INT_MAX; if it is too large, the sprintf() calls can overflow the buffer. The published descript...

CVE-2023-52997

CVE-2023-52997 is a Linux kernel vulnerability affecting ipv4: ip_metrics_convert() where an attacker could exploit speculative execution to leak kernel memory content. The issue arises from using a value as an array index (type) without sufficient protection, allowing a spectre v1 gadget. The de...

CVE-2023-53058

CVE-2023-53058 – Linux kernel (net/mlx5, E-Switch) . The vulnerability arises when handling errors in the E-Switch error path: the code dereferences the pointer named “vport,” which can lead to an oops. The issue is localized to the kernel, requiring local access with low privileges; no user inte...

CVE-2024-26702

The Linux kernel contains a vulnerability in the iio: magnetometer: rm3100 driver. Specifically, the rm3100_common_probe function lacks a sufficient boundary check when reading the value from RM3100_REG_TMRC , leading to an out-of-bound access of the rm3100_samp_rates array. This issue was trigge...

CVE-2024-35791

CVE-2024-35791 affects the Linux kernel KVM: SVM subsystem. It describes a use-after-free in svm_register_enc_region() that is mitigated by flushing converted pages under the kvm lock before releasing the lock, preventing region/pages from being freed by another task. The fix is a patch to perfor...

CVE-2024-35901

CVE-2024-35901 : In the Linux kernel, the mana driver enforced the RX DMA data size to be a multiple of 64, which could cause skb_over_panic on packets slightly larger than MTU+14 (e.g., 1536). The fix removes this alignment requirement; oversized packets are now marked CQE_RX_TRUNCATED by the NI...

CVE-2024-35902

The CVE-2024-35902 issue affects the Linux kernel’s RDS path. In net/rds, a null cp can be dereferenced in __rds_rdma_map when cp->cp_conn is accessed, potentially causing a crash. Analysis notes that cp is a parameter that may be NULL at several call sites (e.g., rds_get_mr, rds_get_mr_for_de...

CVE-2024-36478

CVE-2024-36478 affects the Linux kernel null_blk driver. The issue is a NULL pointer dereference that occurs when power and submit_queues are configured concurrently, leading to a kernel panic via a race between del_gendisk and NR HW queue updates. The fixes consolidate protection by reusing a gl...

CVE-2024-39301

CVE-2024-39301 affects the Linux kernel’s 9P client code path. The issue arises in p9_client_rpc() where, if p9_check_errors() fails early, req->rc.tag may not be initialized, yet trace_9p_client_res() attempts to print it. The root cause is an uninitialized value in the 9P client RPC path, tr...

CVE-2024-41046

CVE-2024-41046 affects the Linux kernel net: ethernet: lantiq_etop driver. The issue is a double-free in detach caused by never incrementing the currently released descriptor, leading to releasing the same skb multiple times. A patch addressing this is published in stable kernels (as cited by the...

CVE-2024-42092

CVE-2024-42092 — Linux kernel GPIO (DaVinci) vulnerability Affected: Linux kernel (gpio: davinci) where pdata->gpio_unbanked is read from the Device Tree. If DT is broken, this value may be invalid and could cause out-of-bounds access to chips->irqs in davinci_gpio_probe(). Root cause: lack...