CVE-2024-41078

CVE-2024-41078 (Linux kernel, btrfs qgroup) fixes a quota root leak that occurs if quota disable cleanup fails, leaking the quota root via fs_info->quota_root. The root cause is a missing btrfs_put_root() on the out path when dropping quota root references; a NULL assignment previously happene...

CVE-2025-37817

Linux kernel vulnerability CVE-2025-37817 involves a double free in the mcb path: in chameleon_parse_gdd(), if mcb_device_register() fails, the code could release mdev via put_device() and then free it again on the error path. The fixed behavior is to return early if mcb_device_register() fails, ...

CVE-2025-37938

CVE-2025-37938 involves the Linux kernel tracing subsystem. The vulnerability centers on the trace event verifier, which checks print formats to ensure pointers reference valid memory that is part of the event or data that will be freed. If an event uses the format "%*p.." and the verifier ignore...

CVE-2010-4083

CVE-2010-4083 affects the Linux kernel (pre-2.6.36). The vulnerable code path is copy_semid_to_user() in ipc/sem.c, where a structure is not initialized, enabling local attackers to leak kernel stack memory via semctl commands (IPC_INFO, SEM_INFO, IPC_STAT, SEM_STAT). The issue is mitigated by up...

CVE-2010-4668

CVE-2010-4668 affects the Linux kernel up to 2.6.37-rc7, where blk_rq_map_user_iov in block/blk-map.c allows a local user to trigger a panic/DoS via a zero-length I/O request to a SCSI device, due to an unaligned map. The vulnerability is tied to an incomplete fix for CVE-2010-4163. Affected vers...

CVE-2011-1017

CVE-2011-1017 relates to a heap-based buffer overflow in the Linux kernel’s LDM code path. Affected component: fs/partitions/ldm.c (ldm_frag_add) in kernel 2.6.37.2 and earlier. Root cause cited in connected docs: bugs in evaluating LDM partitions could crash the kernel for certain corrupted LDM ...

CVE-2011-2496

CVE-2011-2496 affects the Linux kernel prior to 2.6.39. An integer overflow in vma_to_resize (mm/mremap.c) lets local users trigger a BUG_ON and system crash via a crafted mremap call that expands a memory mapping. Mitigation: upgrade to kernel 2.6.39 or later where the issue is fixed. The connec...

CVE-2011-2918

CVE-2011-2918 affects the Linux kernel perf subsystem (Performance Events). The issue arises in the handling of event overflows for PERF_COUNT_SW_CPU_CLOCK, enabling a local attacker to cause a denial of service (system hang) via a crafted application. Public references in connected advisories co...

CVE-2012-2121

CVE-2012-2121 affects the KVM component of the Linux kernel prior to 3.3.4. The vulnerability stems from improper management of the relationships between memory slots and the iommu, enabling guest OS users (with administrative access inside the guest) to trigger hotplug/hotunplug operations on de...

CVE-2012-3511

The CVE-2012-3511 entry maps to the Linux kernel issue in mm/madvise.c: madvise_remove contains race conditions that can be exploited locally to trigger use-after-free and kernel crash, resulting in denial of service via munmap or close. Affected lineage includes kernels before 3.4.5; patches add...

CVE-2013-2892

The CVE-2013-2892 issue affects the Linux kernel HID subsystem specifically the HID driver at drivers/hid/hid-pl.c. When CONFIG_HID_PANTHERLORD is enabled, a physically proximate crafted HID device can cause a heap-based out-of-bounds write, leading to a denial of service. The provided documents ...

CVE-2013-4162

CVE-2013-4162 : In the Linux kernel (IPv6 UDP implementation), the function udp_v6_push_pending_frames in net/ipv6/udp.c calls an incorrect function for pending data. This yields a local denial of service (BUG and system crash) when a crafted application uses UDP_CORK via setsockopt. Affected ver...

CVE-2014-8369

The CVE-2014-8369 flaw affects the Linux kernel and is caused by a miscalculation in kvm_iommu_map_pages (virt/kvm/iommu.c) when handling a mapping failure. The vulnerability exists in kernels up to 3.17.2 and arises from an incorrect fix for CVE-2014-3601. This allows guest OS users with privile...

CVE-2014-9090

CVE-2014-9090 affects the Linux kernel up to 3.17.4, where do_double_fault in arch/x86/kernel/traps.c mishandles SS fault conditions, allowing local users to cause a denial of service (panic) via modify_ldt (demonstrated by sigreturn_32 in linux-clock-tests). The issue was addressed by a patch li...

CVE-2014-9731

The CVE-2014-9731 entry concerns the Linux kernel’s UDF filesystem (CONFIG_UDF_FS) for versions before 3.18.2. The vulnerability arises because the UDF symlink path length validation may not accommodate space for storing a symlink target’s name plus a trailing NUL, enabling a local attacker to ob...

CVE-2015-2042

CVE-2015-2042 affects the Linux kernel (pre-3.19). The vulnerability lies in net/rds/sysctl.c where an incorrect data type in a sysctl table can allow local users to read potentially sensitive kernel memory via a sysctl entry, with unspecified other impact. Affected products include kernel builds...

CVE-2015-8569

The CVE-2015-8569 issue affects the Linux kernel’s PPTP path: pptp_bind() and pptp_connect() in drivers/net/ppp/pptp.c do not verify the length of the sockaddr, enabling a local attacker to copy kernel memory to user space and bypass KASLR via a crafted application. The vulnerability is present i...

CVE-2015-8575

CVE-2015-8575: In Linux kernel

CVE-2017-5123

CVE-2017-5123 is a Linux kernel local privilege-escalation vulnerability in the waitid path. The waitid handler in kernel/exit.c writes to user memory by calling unsafe_put_user without performing an access_ok() check, and without wrapping user-space writes in the required user_access_begin()/use...

CVE-2018-11508

CVE-2018-11508 affects the Linux kernel’s compat_get_timex implementation in kernel/compat.c, allowing a local attacker to disclose kernel memory via adjtimex, with affected versions up to but before 4.16.9. The issue’s public fixes are documented in ChangeLog-4.16.9 and Ubuntu security advisorie...

CVE-2021-47162

CVE-2021-47162 affects the Linux kernel TIPC path. The vulnerability arises when reassembling messages and appending a frag skb to a skb’s frag_list: if the frag_list already contains skbs from elsewhere (e.g., cloned/shared by multiple skbs), the appended frag skb may be observed by multiple skb...

CVE-2021-47483

CVE-2021-47483 affects the Linux kernel regmap subsystem (regcache_rbtree). The issue is a double-free in error handling when a reallocation fails, causing rbnode->block to reference freed memory. The fix moves the rbnode->block assignment to immediately after a successful reallocation, ens...

CVE-2021-47576

CVE-2021-47576 concerns the Linux kernel SCSI subsystem, specifically the scsi_debug driver. The issue is a use-after-free (UAF) caused by insufficient validation of the block descriptor length in resp_mode_select(), leading to a KASAN crash (Read of size 1) in resp_mode_select() and related SCSI...

CVE-2022-2590

Astra Linux bulletin confirms CVE-2022-2590 was addressed in Linux kernel MM/GUP logic by fixing FOLL_FORCE COW security issue and removing FOLL_COW. The patch targets races where a read-only shared page could become writable via FOLL_FORCE during COW, enabling unprivileged local writes to read‑o...

CVE-2022-48662

CVE-2022-48662 affects the Linux kernel i915 driver (i915_gem_context.link protection). The issue arises when removing a context from the gem.contexts list during context_close(), which can poison link.next while i915_perf holds a reference, leading to a general protection fault during i915_perf_...

CVE-2022-49279

The CVE-2022-49279 issue affects the Linux kernel’s NFSD component and arises from an integer overflow on 32‑bit systems in the operation len * sizeof(*p). Public descriptions in the provided documents confirm the root cause and affected area, but do not specify a fixed patch version or remediati...

CVE-2022-49309

CVE-2022-49309 (Linux kernel) describes a deadlock in drivers: staging: rtl8723bs, specifically in rtw_surveydone_event_callback(). The issue occurs when a thread holds pmlmepriv->lock inside the callback and calls del_timer_sync() to stop a timer that is also needed by the timer handler, caus...

CVE-2022-49564

CVE-2022-49564 : Linux kernel crypto qat flaw where DH parameter handling could underflow. The fix rejects requests when the source buffer is larger than the key, preventing an underflow when copying the source scatterlist into a linear buffer. Documents/refs show the fix being incorporated in ke...

CVE-2023-32248

CVE-2023-32248 describes a flaw in the Linux kernel’s ksmbd (the in-kernel SMB server) related to the handling of SMB2_TREE_CONNECT and SMB2_QUERY_INFO. The issue stems from the lack of proper validation of a pointer before access, which attackers can leverage to cause a denial-of-service conditi...

CVE-2023-52937

Summary: CVE-2023-52937 affects the Linux kernel’s hv_balloon path. The vulnerability arises from a memory leak when using debugfs_lookup(): the result must be released with dput(), but this handling is not performed in the hv_balloon code. The available connected sources state the fix is to call...

CVE-2023-52991

CVE-2023-52991 affects the Linux kernel’s skb_segment_list path. The issue stems from a prior change: net: Support GRO/GSO fraglist chaining, which can cause frag_list to be NULL if it is pulled into the linear area during processing. This condition leads to a NULL pointer dereference in skb_segm...

CVE-2023-53046

Summary: CVE-2023-53046 is a Linux kernel vulnerability in Bluetooth HCI path. A race between hci_cmd_sync_work and hci_cmd_sync_clear can cause a use-after-free of the cmd_sync_work_list entry, potentially leading to a kernel panic when hci_cmd_sync_work is processed. The issue is triggered duri...

CVE-2023-53068

CVE-2023-53068 is reported in the Linux kernel under net: usb: lan78xx: Limit packet length to skb->len. The vulnerability arises when the packet length read from the descriptor may exceed skb->len, causing a cloned skb passed up the network stack to leak kernel memory contents. A fix was a...

CVE-2024-26647

CVE-2024-26647 affects the Linux kernel DRM/AMD display component. In link_set_dsc_pps_packet(), a dereference of struct display_stream_compressor *dsc could occur (dsc->ctx->logger) before a NULL pointer check, enabling a potential crash when the dsc pointer is NULL. The issue has been fix...

CVE-2024-26655

CVE-2024-26655 affects the Linux kernel. The issue is a memory leak in posix_clock_open: if clk ops.open() returns an error, the pccontext allocated for the clock is not released. The fix reorganizes the code to make the behavior clearer and applies a patch in the kernel’s clock handling. Practic...

CVE-2024-26702

CVE-2024-26702 : In the Linux kernel, the iio: magnetometer RM3100 driver added a boundary check for the value read from RM3100_REG_TMRC to prevent an out-of-bounds access that could crash rm3100_common_probe. The crash was caused by out-of-bounds access of the rm3100_samp_rates array due to hard...

CVE-2024-26881

The CVE-2024-26881 issue is a Linux kernel vulnerability affecting net: hns3 on HIP08 devices. The root cause is a NULL pointer dereference when an 1588/IEEE-1588 message is received because HIP08 devices do not register ptp devices, leaving hdev->ptp NULL, and the code may access hdev->ptp...

CVE-2024-38560

The CVE-2024-38560 entry concerns Linux kernel SCSI (bfa) code. A vulnerable path copies nbytes from userspace into a kernel buffer without guaranteeing a NUL terminator, enabling an OOB read when sscanf is applied. The issue is fixed by replacing memdup_user with memdup_user_nul to ensure proper...

CVE-2024-38580

CVE-2024-38580 is a Linux kernel vulnerability in the epoll path where epoll could race with the last fput(), causing a file reference to go dead and potentially leading to use-after-free when epoll calls into vfs_poll(). The fix adds a validation to ensure a valid file reference is held before d...

CVE-2024-40937

CVE-2024-40937 refers to a Linux kernel vulnerability in the gve driver where napi->skb was not cleared before freeing the skb with dev_kfree_skb_any(), potentially leaving a dangling napi pointer returned by napi_get_frags. The fix clears napi->skb before the skb is freed. Connected docume...

CVE-2024-41036

CVE-2024-41036 - Linux kernel ks8851 deadlock fix (SPI variant). The issue arises when SMP is enabled and spinlocks are functional, causing a deadlock between ks8851_start_xmit_spi and ks8851_irq via the statelock. Affected: ks8851 TX path in the Linux kernel net driver. Impact: potential soft lo...

CVE-2024-41047

CVE-2024-41047 affects the Linux kernel i40e driver handling of XDP programs during driver removal. The root cause was a PF state flag (__I40E_IN_REMOVE) intended to block XDP program changes, which proved insufficient when .ndo_bpf() was invoked outside rmmod context, risking a kernel warning wh...

CVE-2024-41072

CVE-2024-41072 affects the Linux kernel wifi subsystem (cfg80211 wext). The fix adds an extra validation in cfg80211_wext_siwscan() to ensure the number of channels passed via ioct(SIOCSIWSCAN, ...) does not exceed IW_MAX_FREQUENCIES; requests that exceed this limit are rejected with -EINVAL. Thi...

CVE-2024-42105

CVE-2024-42105 – nilfs2 inode range/UAF fixes in Linux kernel : The referenced security issue is mitigated by a patch series for nilfs2 that fixes a use-after-free and several inode-number range problems. Specifically, nilfs->ns_first_ino (the first non-reserved inode) was read from the superb...

CVE-2024-42107

CVE-2024-42107 affects the Linux kernel ice driver’s PTP support. The issue is a race between ice_ptp_extts_event() and ice_ptp_release() that can dereference a NULL pointer (ptp_clock_event called with NULL) after the PTP clock has been released, causing a kernel panic. The documented fix is to ...

CVE-2024-42148

The CVE-2024-42148 has concrete technical details in connected docs: it concerns the bnx2x driver in the Linux kernel and UBSAN array-index-out-of-bounds warnings. The root cause is an out-of-bounds access on the stats_query_entry query array inside bnx2x_fw_stats_req (drivers/net/ethernet/broadc...

CVE-2024-42224

CVE-2024-42224 relates to the Linux kernel mv88e6xxx DSA driver. The root cause was an incorrect check for an empty list: mv88e6xxx_default_mdio_bus() validated list_first_entry() is non-NULL, which does not properly detect an empty list. The fix uses list_first_entry_or_null(), which returns NUL...

CVE-2024-43831

The CVE-2024-43831 vulnerability affects the Linux kernel media/mediatek/vcodec path, specifically the vpu_dec_init function where an invalid decoder VSI could be mishandled. The fix, as documented, ensures the decoder VSI is valid for future use, reducing the risk of exploitation. The issue is c...

CVE-2024-43880

CVE-2024-43880 affects the Linux kernel mlxsw Spectrum ACL TCAM handling. The issue arises in the TCAM masking logic where object aggregation hints could form nested objects (A-TCAM/C-TCAM) due to an aggregation‑helper in the objagg library and driver interaction. This could produce non‑optimal o...

CVE-2024-44977

In CVE-2024-44977, the Linux kernel module drm/amdgpu is affected by a missing TA binary size validation that could allow an out-of-bounds write. The issue is resolved by adding TA binary size validation to the TA handling path. The fix was cherry-picked from commit c0a04e3570d72aaf090962156ad085...