CVE-2024-43831

The CVE-2024-43831 vulnerability affects the Linux kernel media/mediatek/vcodec path, specifically the vpu_dec_init function where an invalid decoder VSI could be mishandled. The fix, as documented, ensures the decoder VSI is valid for future use, reducing the risk of exploitation. The issue is c...

CVE-2024-43880

CVE-2024-43880 affects the Linux kernel mlxsw Spectrum ACL TCAM handling. The issue arises in the TCAM masking logic where object aggregation hints could form nested objects (A-TCAM/C-TCAM) due to an aggregation‑helper in the objagg library and driver interaction. This could produce non‑optimal o...

CVE-2024-44977

In CVE-2024-44977, the Linux kernel module drm/amdgpu is affected by a missing TA binary size validation that could allow an out-of-bounds write. The issue is resolved by adding TA binary size validation to the TA handling path. The fix was cherry-picked from commit c0a04e3570d72aaf090962156ad085...

CVE-2024-45028

Summary (CVE-2024-45028) : The vulnerability is in the Linux kernel code path mmc_test, where the allocation of test->highmem via alloc_pages() can lead to a NULL dereference when __free_pages(test->highmem) executes after allocation failure. The fix changes the dereference handling to avoi...

CVE-2024-46730

CVE-2024-46730 is a Linux kernel vulnerability in drm/amd/display where tg_inst could be -1 (negative) if timing_generator_count equals 0. The patch fixes two related overrun issues by ensuring the array index tg_inst is never used when invalid, preventing potential out-of-bounds operations. The ...

CVE-2024-47714

CVE-2024-47714 affects the Linux kernel module for MT7996 WiFi (mt76). The vulnerability stems from using hweight8 on a 16-bit chainmask, causing incorrect tx_ant values (band 2); without the patch, tx_ant could become -1, triggering a KASAN stack-out-of-bounds condition in mt7996_mcu_add_sta. Th...

CVE-2024-47736

CVE-2024-47736 relates to the Linux kernel EROFS handling of overlapped pclusters in crafted images. The issue caused a potential task hang/deadlock while waiting on the folio lock during cache I/O, triggered by fuzzed images with overlapping big pclusters. Root causes described include mis-arran...

CVE-2024-49854

CVE-2024-49854 affects the Linux kernel’s block/bfq path. The root cause was a use-after-free (UAF): after bfq_split_bfqq(), if the current process is the last holder of bfqq, the bfqq can be freed and then bfqq->waker_bfqq could be accessed, with the waker potentially in the merge chain. The ...

CVE-2024-49857

CVE-2024-49857 (Linux kernel) involves the wifi iwlwifi mvm path where the cipher pointer is not initialized before it is dereferenced during secured NDP ranging. The underlying bug is a NULL pointer dereference caused by dereferencing an uninitialized cipher pointer. The fixed description states...

CVE-2024-49926

CVE-2024-49926 affects the Linux kernel’s rcu-tasks path (rcu_tasks_need_gpcb). The root cause is an access to a non-existent percpu rtpcp variable when CONFIG_FORCE_NR_CPUS=y, causing nr_cpu_ids to resolve to NR_CPUS instead of the number of possible CPUs, which can lead to a kernel page fault a...

CVE-2024-50000

CVE-2024-50000 affects the Linux kernel mlx5e driver: in mlx5e_tir_builder_alloc(), kvzalloc() may return NULL and the code dereferences it, causing a NULL pointer dereference. The vulnerability is fixed by the upstream patch in the Linux kernel; remediation is to upgrade to a version containing ...

CVE-2024-50026

CVE-2024-50026 affects the Linux kernel SCSI wd33c93 path. A regression from the commit that moved scsi_pointer from hostdata->connected to private command data caused an oops in wd33c93_intr() because hostdata->connected is not valid during selection. The fix retrieves the current scsi_poi...

CVE-2024-50030

CVE-2024-50030 refers to a Linux kernel vulnerability in drm/xe/ct where a use-after-free (UAF) could occur due to fence/timeout interactions. The fix serializes with the completion side by grabbing ct->lock after the wait to ensure correct ordering of dependent loads/stores and to prevent UAF...

CVE-2024-50111

CVE-2024-50111 affects LoongArch Linux kernel where unaligned access can trigger in irq-enabled context; do_ale() may call get_user(), causing sleep and BUG: sleeping function called from invalid context. The fix described in the unpatched Nessus entry is to enable IRQ handling for unaligned acce...

CVE-2024-50118

CVE-2024-50118 relates to the Linux kernel Btrfs remount/RW reconfiguration path. The issue arises during mounting different subvolumes with conflicting RO/RW flags: an initial read-only mount (ro) followed by an attempt to remount a subvolume as read/write, with options/feature checks being skip...

CVE-2024-53212

CVE-2024-53212 is a Linux kernel vulnerability where a false positive warning in netlink extack could occur during dumps. The fix reworks the validation by using the netlink message header (nlh) instead of scanning skb->data, addressing a scenario where a dump is initiated but not completed du...

CVE-2024-57801

CVE-2024-57801 affects the Linux kernel in the mlx5e driver: during unload, a use-after-free can occur when accessing rpriv->netdev or walking rpriv->tc_ht for a vport representor that is not fully loaded. The root cause is missing checks when restoring TC rules for the vport representor, l...

CVE-2024-58086

CVE-2024-58086 affects the Linux kernel DRM/V3D path. The issue arises when destroying an active perfmon: the kernel previously left v3d->active_perfmon as a stale pointer, potentially causing undefined behavior and instability. The description notes a patch to stop the active perfmon before d...

CVE-2025-21724

CVE-2025-21724: In the Linux kernel’s iommufd/iova_bitmap, UBSAN shift-out-of-bounds occurred in iova_bitmap_offset_to_index() when shifting the constant 1 by bitmap->mapped.pgshift (unsigned long). If pgshift > 31, the 32-bit int shift overflowed, causing undefined behavior. The fix promot...

CVE-2025-21894

The CVE-2025-21894 issue affects Linux kernel ENETC, where Virtual Functions (VFs) do not support HWTSTAMP_TX_ONESTEP_SYNC because only the PF can access PMa_SINGLE_STEP registers. The result is a crash when VFs attempt one-step timestamping, as illustrated by the kernel crash trace. A fix has be...

CVE-2025-21918

CVE-2025-21918 is a Linux kernel vulnerability described in connected Azure Linux advisory: usb: typec: ucsi: Fix NULL pointer access. The issue arises from premature resource release; the fix ensures resources are freed only after the associated workqueue completes, preventing NULL-pointer acces...

CVE-2025-22026

CVE-2025-22026 (Linux kernel) affects nfsd in the kernel. The issue: nfsd_proc_stat_init() ignored the return value of svc_proc_register(), so if procfile creation fails the kernel may WARN later during removal. The fix updates nfsd_proc_stat_init() to return the same pointer type as svc_proc_reg...

CVE-2025-23149

CVE-2025-23149 refers to a Linux kernel vulnerability in TPM handling. The issue is triggered when TPM_CHIP_FLAG_SUSPENDED is checked after tpm_find_get_ops(), which can spuriously invoke tpm_chip_start() while the TPM chip is suspended. The provided logs show a sequence leading to a potential tr...

CVE-2025-37748

CVE-2025-37748 : In the Linux kernel, the iommu/mediatek fix prevents a NULL pointer dereference in mtk_iommu_device_group during probe. The issue occurred because iommu_device_register could be called before the driver data’s hw_list was initialized, causing a dereference when list_first_entry i...

CVE-2010-0307

CVE-2010-0307 affects the Linux kernel (x86_64) prior to 2.6.32.8 where load_elf_binary in fs/binfmt_elf.c may call SET_PERSONALITY before confirming the ELF interpreter exists, enabling a local DoS via a 32-bit process launching a 64-bit one and triggering a segmentation fault (flush_old_exec re...

CVE-2010-3084

CVE-2010-3084 refers to a buffer overflow in the Linux kernel 2.6 series (niu_get_ethtool_tcam_all in drivers/net/niu.c) exploitable via the ETHTOOL_GRXCLSRLALL ethtool command. Affected: Linux kernel older than 2.6.36-rc4. Impact described as local denial of service and potential other effects (...

CVE-2010-4080

CVE-2010-4080 affects the Linux kernel: snd_hdsp_hwdep_ioctl in sound/pci/rme9652/hdsp.c does not initialize a structure, enabling local attackers to leak kernel stack information via SNDRV_HDSP_IOCTL_GET_CONFIG_INFO. Affected products/versions: Linux kernel before 2.6.36-rc6. Impact is an inform...

CVE-2011-1044

CVE-2011-1044 affects the Linux kernel (pre-2.6.37) and is caused by ib_uverbs_poll_cq in drivers/infiniband/core/uverbs_cmd.c not initializing a certain response buffer. This allows local attackers to read potentially sensitive data from kernel memory via vectors that fill the buffer only partia...

CVE-2011-1090

CVE-2011-1090 affects the Linux kernel’s NFSv4 ACL handling: the function __nfs4_proc_set_acl in fs/nfs/nfs4proc.c allocates memory with kmalloc but does not always free it, enabling a local attacker to trigger a denial of service (panic) by crafting an ACL set operation. The vulnerability is doc...

CVE-2011-1172

The CVE-2011-1172 issue affects the Linux kernel IPv6 stack (net/ipv6/netfilter/ip6_tables.c): root cause is failure to append a null terminator to certain string values, enabling local memory information disclosure via a crafted request (CAP_NET_ADMIN) and reading the modprobe argument. Impact i...

CVE-2011-2498

CVE-2011-2498 affects the Linux kernel: versions prior to 2.6.39 allow local unprivileged users to trigger creation of PTE pages, causing memory consumption and a denial of service. The issue is rooted in how PTE pages are accounted for during OOM scoring. Public disclosures reference Ubuntu, SUS...

CVE-2011-4086

The CVE-2011-4086 vulnerability affects the Linux kernel prior to 3.3.1, where journal_unmap_buffer in fs/jbd2/transaction.c mishandles _Delay and _Unwritten journal buffer head states. This can crash the system (local DoS) when an ext4 filesystem is mounted with a journal. Remediation: upgrade t...

CVE-2011-5321

The vulnerability CVE-2011-5321 affects the Linux kernel up to version 3.1.0, specifically the tty_open function in drivers/tty/tty_io.c, where a driver-lookup failure can lead to a NULL pointer dereference and system crash via crafted access to /dev/pts devices. Local users can cause a denial of...

CVE-2013-6368

CVE-2013-6368 affects the KVM subsystem in the Linux kernel up to version 3.12.5, enabling local users to gain privileges or trigger a denial of service (system crash) via a VAPIC synchronization operation involving a page-end address. The connected advisories for MiracleLinux, Unity Linux, and E...

CVE-2013-6382

CVE-2013-6382 refers to multiple buffer underflows in the Linux kernel’s XFS implementation up to version 3.12.1, allowing local, CAP_SYS_ADMIN–bearing users to trigger memory corruption or potential other impacts via the XFS_IOC_ATTRLIST_BY_HANDLE or XFS_IOC_ATTRLIST_BY_HANDLE_32 ioctls with cra...

CVE-2013-7265

CVE-2013-7265 affects the Linux kernel; the pn_recvmsg function in net/phonet/datagram.c updates a length value before the associated data structure is initialized, enabling local users to read sensitive kernel stack memory via recvfrom/recvmmsg/recvmsg calls. Impact is a local information leak. ...

CVE-2014-3184

The CVE-2014-3184 entry concerns the Linux kernel HID subsystem prior to 3.16.2, where report_fixup can be abused by a crafted device with a small HID report descriptor to trigger an out-of-bounds write and denial of service when the device is physically proximate. Affected components include HID...

CVE-2014-4655

CVE-2014-4655 affects the Linux kernel ALSA control path: snd_ctl_elem_add in sound/core/control.c does not correctly maintain user_ctl_count, enabling a local DoS via a large number of SNDRV_CTL_IOCTL_ELEM_REPLACE calls to /dev/snd/controlCX. Affected: Linux kernel prior to 3.15.2 (ALSA control ...

CVE-2015-8944

CVE-2015-8944 concerns the Linux kernel up to version 4.7 (as used in Android on Nexus 6/7 devices before 2016-08-05). The ioresources_init function in kernel/resource.c uses weak permissions for /proc/iomem, allowing local users to read this file and obtain sensitive information. The description...

CVE-2016-2547

The CVE-2016-2547 issue affects Linux kernel sound/core/timer.c prior to 4.4.1. The root cause is a locking approach that ignores slave timer instances, enabling a local attacker to trigger a denial-of-service via a crafted ioctl (race condition/use-after-free leading to system crash). Public adv...

CVE-2016-2549

CVE-2016-2549 affects the Linux kernel prior to version 4.4.1, where sound/core/hrtimer.c fails to prevent recursive callback access, enabling local users to trigger a denial of service (deadlock) via a crafted ioctl. Connected advisories (Unity Linux UTSA-2026-000840/000...) confirm this issue i...

CVE-2017-16528

CVE-2017-16528 affects the Linux kernel: sound/core/seq_device.c prior to version 4.13.4. A crafted USB device can trigger a use-after-free in snd_rawmidi_dev_seq_free , causing local DoS and potential system crash. Impact is described as high for confidentiality, integrity, and availability in t...

CVE-2017-16648

CVE-2017-16648 affects the Linux kernel, specifically the dvb_frontend_free function in drivers/media/dvb-core/dvb_frontend.c, up to kernel 4.13.11. The issue is a use-after-free in the DVB frontend management path that can be triggered by a crafted USB device, enabling local users to cause a den...

CVE-2021-47177

CVE-2021-47177 is a kernel-level issue in the Linux IOMMU VT-d subsystem where iommu_device_sysfs_add() leaked sysfs state on error. The published description and connected advisories state that the leak occurs in alloc_iommu() and that the sysfs entry must be cleaned on subsequent errors; a fix ...

CVE-2021-47203

The CVE-2021-47203 entry describes a Linux kernel vulnerability in the lpfc SCSI driver (lpfc_drain_txq) where, on a failed attempt to pass requests to the adapter, a local failure message (fail_msg) is set and jobs may be added to the completions list, risking list corruption. The fixed behavior...

CVE-2021-47348

The CVE-2021-47348 issue affects the Linux kernel, specifically the DRM AMD display path. The root cause is HDCP over-read/corruption due to reading 8 bytes instead of the targeted 5 bytes for a field; this could yield a corrupted value if trailing bytes are non-zero. The fix introduces a properl...

CVE-2022-48651

CVE-2022-48651 affects the Linux kernel ipvlan path. When an AF_PACKET socket uses PACKET_QDISC_BYPASS and the default xmit path is switched, skb->mac_header may remain at 65535, yielding slab-out-of-bounds in ipvlan_xmit_mode_l2. Root causes: packet_snd() only resets skb->mac_header for SO...

CVE-2022-48816

CVE-2022-48816 affects the Linux kernel SUNRPC subsystem. The issue is a race where a ->sock can be set to NULL asynchronously during a sysfs read unless the recv_mutex is held, potentially triggering an oops. A patch attempt in commit 17f09d3f619a aimed to check xprt connectivity before handl...

CVE-2022-48953

CVE-2022-48953 — Linux kernel rtc-cmos init-order bug. The issue arises when rtc_handler() accesses driver data before cmos_do_probe() has completed, causing a NULL pointer dereference if the RTC fixed event fires at boot. The fix changes initialization order so that cmos_wake_setup() is called a...

CVE-2022-49238

CVE-2022-49238 concerns the Linux kernel ath11k driver for QCA6390/WCN6855. The issue arises when disconnecting from an AP: a commit sequence intended to fix a firmware crash ended up skipping all peer deletion, leaving peer->sta set and then used, causing a use-after-free. The log shows a use...