14999 matches found
CVE-2024-49855
CVE-2024-49855 : In the Linux kernel, a race between timeout handling and normal completion in the nbd path can lead to use-after-free. The fix clears NBD_CMD_INFLIGHT in nbd_requeue_cmd() and ensures cmd->lock is held when clearing the flag and requeueing, preventing premature completion of a...
CVE-2012-6638
CVE-2012-6638 (Linux kernel) affects the tcp_rcv_state_process in net/ipv4/tcp_input.c and can cause a DoS due to a flood of SYN+FIN packets. The vulnerability exists in kernels before 3.2.24 and is fixed in the 3.2.24 update (per ChangeLog-3.2.24). Exploitation is described as remote and results...
CVE-2013-1774
CVE-2013-1774 affects the Linux kernel (drivers/usb/serial/io_ti.c) prior to 3.7.4. The chase_port function allows local users to trigger a NULL pointer dereference and system crash by performing a read or write on a disconnected Edgeport USB serial converter, resulting in a denial of service. Th...
CVE-2013-4162
CVE-2013-4162 : In the Linux kernel (IPv6 UDP implementation), the function udp_v6_push_pending_frames in net/ipv6/udp.c calls an incorrect function for pending data. This yields a local denial of service (BUG and system crash) when a crafted application uses UDP_CORK via setsockopt. Affected ver...
CVE-2014-8709
The CVE affects the Linux kernel: ieee80211_fragment in net/mac80211/tx.c, vulnerable in versions before 3.13.5 due to an improperly maintained tail pointer which can allow remote attackers to read packets and obtain cleartext information. A fix is available in Linux kernel 3.13.5 and later (see ...
CVE-2015-5697
CVE-2015-5697 (Linux kernel) : The get_bitmap_file function in drivers/md/md.c in the Linux kernel before 4.1.6 does not initialize a bitmap data structure, allowing local attackers to read sensitive kernel memory via the GET_BITMAP_FILE ioctl. This is a local information disclosure vulnerability...
CVE-2016-3713
CVE-2016-3713 affects the Linux kernel up to version 4.6.0 (fixed in 4.6.1). The vulnerability lies in msr_mtrr_valid() in arch/x86/kvm/mtrr.c, which incorrectly supports MSR 0x2f8 and allows a guest OS user to read or write the kvm_arch_vcpu data structure. Impact includes potential information ...
CVE-2016-5412
CVE-2016-5412 affects the Linux kernel on PowerPC with CONFIG_KVM_BOOK3S_64_HV enabled. A guest OS user can trigger a host denial of service (infinite loop) by issuing a H_CEDE hypercall while a transaction is suspended. The description in the supplied documents confirms the affected file and con...
CVE-2017-14497
CVE-2017-14497 describes a vulnerability in the Linux kernel’s tpacket_rcv() path (net/packet/af_packet.c) where the code mishandles vnet headers. It is triggered by crafted system calls and, per the connected Nessus entries, could allow a local attacker to cause a denial of service via buffer ov...
CVE-2017-18079
CVE-2017-18079 affects the Linux kernel, state: a NULL pointer dereference in drivers/input/serio/i8042.c can crash the system because the port->exists value can change after validation, leading to a denial of service or potentially other impact. Public docs specify the vulnerable condition is...
CVE-2018-14616
CVE-2018-14616 involves a NULL pointer dereference in the Linux kernel before 4.17.10. The flaw occurs in fscrypt_do_page_crypto() (fs/crypto/crypto.c) when handling a file inside a corrupted f2fs image. Affects the Linux kernel up to 4.17.10; the issue can cause a kernel crash (availability impa...
CVE-2018-14619
CVE-2018-14619 affects the Linux kernel crypto subsystem prior to version 4.15-rc4: the null skcipher was freed when af_alg_ctxs were freed instead of when the aead_tfm was freed. This can allow a local user to crash the system or potentially escalate privileges. The connected Nessus advisories (...
CVE-2021-47074
In CVE-2021-47074, the Linux kernel nvme-loop module had a memory leak in nvme_loop_create_ctrl(): if nvme_init_ctrl() fails, the created loop ctrl must be freed before exiting. The fix ensures proper cleanup of the loop ctrl on error to avoid leaking memory. The vulnerability’s described impact ...
CVE-2022-49313
CVE-2022-49313 : Linux kernel patch fixes a deadlock in usb host oxu_bus_suspend(). The issue arises when oxu_bus_suspend() holds oxu->lock while waiting for a timer to stop via del_timer_sync(), but the timer handler also needs the same lock, causing a potential deadlock. The patch removes de...
CVE-2022-49332
CVE-2022-49332 relates to the Linux kernel SCSI lpfc path. The vulnerability is a NULL pointer dereference in starget_to_rport() where calls may return NULL and the code could dereference a NULL rport. The described root cause is lack of a NULL check before dereferencing the rport, with the cited...
CVE-2022-49778
CVE-2022-49778 concerns the Linux kernel on arm64 where pmd_user_accessible_page() incorrectly treated non-leaf PMDs as leaf, causing a decrease of file_map_count for non-leaf PMDs during collapse of huge pages and triggering a BUG_ON() in mm/page_table_check.c. The provided connected documents c...
CVE-2022-49804
CVE-2022-49804 refers to a Linux kernel issue affecting s390 where making current_stack_pointer a global register variable exposed a gcc bug. The vulnerability is tied to stack pointer handling and can lead to stack corruption on affected builds. Public description notes that to mitigate, the min...
CVE-2023-52504
CVE-2023-52504 affects the Linux kernel (x86/alternatives) where KASAN can misbehave when apply_alternatives() patches CPU LA57-related features on 5-level paging systems. The issue arises because KASAN_SHADOW_START is derived from __VIRTUAL_MASK_SHIFT, which depends on cpu_feature_enabled(), lea...
CVE-2023-52518
Astra Linux security bulletin confirms CVE-2023-52518 affecting the Linux kernel Bluetooth stack: hci_codec: Fix leaking content of local_codecs. The vulnerability arises when codecs are stored in the local_codecs list and elements aren’t freed, causing a memory leak. The bulletin notes a patch t...
CVE-2023-52868
CVE-2023-52868 is a Linux kernel vulnerability in the thermal: core component that can cause a string overflow. The root cause is that the dev->id value is derived from ida_alloc() and can be up to INT_MAX; if it is too large, the sprintf() calls can overflow the buffer. The published descript...
CVE-2023-53014
The CVE-2023-53014 issue affects the Linux kernel’s DMA engine (tegra). It describes a memory leak that occurs when terminating an ongoing transfer: the vdesc must be terminated and placed in the desc_terminated list, with the descriptor freed later in desc_free_list(). The provided connected doc...
CVE-2023-53079
The CVE-2023-53079 issue affects the Linux kernel mlx5 driver (net/mlx5) and related eswitch/vport flow-rule handling. Root cause: during EEH, vport MC/UC/multicast promiscuous rules aren’t deleted in teardown, and the firmware may reset these settings after EEH, causing the driver to attempt to ...
CVE-2023-53105
CVE-2023-53105 affects the Linux kernel mlx5 driver, specifically a NULL pointer dereference in encap lock cleanup when unloading a module with a peer offloaded TC flow. The underlying issue occurs when the peer uplink rep profile is changed to a NIC profile and the encap lock is destroyed during...
CVE-2023-53113
The CVE-2023-53113 entry concerns the Linux kernel wifi NL80211 offchannel check. A NULL-pointer dereference could occur when a link was created by userspace in AP mode but not activated yet, resulting in a chandef that is invalid or has no channel. The vulnerability arises from dereferencing thi...
CVE-2024-26917
CVE-2024-26917 affects the Linux kernel SCSI/FCoE path. The vulnerability stems from reverting a commit that changed spin lock usage for FCoE devices (from bh to irqsave), which caused interrupts to be lost for FCoE devices. The problem was introduced in the patch set around scsi: fcoe: Fix poten...
CVE-2024-26942
CVE-2024-26942 (Linux kernel) affects the qcom at803x PHY driver (at8031) in the Linux kernel. The root cause is a NULL dereference where the private data (priv) is referenced before it has been allocated during the driver’s rework/split, causing a kernel panic when probing at8031. The fix ensure...
CVE-2024-35922
The CVE-2024-35922 issue is a Linux kernel vulnerability in fbmon/fb_videomode_from_videomode() where htotal * vtotal can overflow to zero, risking division by zero. The root cause is overflow during videomode computation; the fix mirrors fb_var_to_videomode() by preventing division by zero. Affe...
CVE-2024-35956
CVE-2024-35956 affects the Linux kernel's btrfs quota groups handling. During subvolume create/snapshot/delete, metadata reservations are made via btrfs_subvolume_reserve_metadata(). When quotas are enabled, a PREALLOC qgroup reservation is created and later converted to PERTRANS after the operat...
CVE-2024-35998
CVE-2024-35998 – Linux kernel SMB3 deadlock fix Root cause: In cifs_sync_mid_result, incorrect lock ordering could cause a thread deadlock (ORDER_REVERSAL) where TCP_Server_Info.srv_lock is acquired while TCP_Server_Info.mid_lock is held. Impact: Deadlock potential in the SMB/CIFS path (smb3) wit...
CVE-2024-36479
Technical details about CVE-2024-36479 are not provided in the connected documents. Public information in the initial description is high level. Monitor for updates and additional details from vendor/maintainer advisories.
CVE-2024-39371
CVE-2024-39371 affects the Linux kernel io_uring path. The issue arises in io_file_can_poll() when a forced ASYNC request has a bad or unassigned file descriptor, potentially triggering a NULL pointer dereference via the forced async preparation path. The vulnerability is demonstrated in the trac...
CVE-2024-40937
CVE-2024-40937 is a kernel vulnerability affecting the gve component where gve_rx_free_skb() leaves napi->skb pointing to a freed skb, risking a dangling pointer in subsequent napi_get_frags calls. The issue is resolved by clearing napi->skb before dev_kfree_skb_any() frees the skb. Connect...
CVE-2024-40939
CVE-2024-40939 (Linux kernel) : The issue affects the Linux kernel net/wwan/iosm path. When region creation fails in ipc_devlink_create_region(), the delete path used a tainted pointer that actually held an error code. The fix decreases the region index before performing the delete to avoid taint...
CVE-2024-41050
CVE-2024-41050 (Linux kernel) affects the cachefiles subsystem, specifically the ondemand path handling of object reopening. The vulnerability arises from cyclic re-use of msg_id after a malicious reopen, which can cause a read request to remain unprocessed and lead to a hang. The root cause is r...
CVE-2024-41078
CVE-2024-41078 (Linux kernel, btrfs qgroup) fixes a quota root leak that occurs if quota disable cleanup fails, leaking the quota root via fs_info->quota_root. The root cause is a missing btrfs_put_root() on the out path when dropping quota root references; a NULL assignment previously happene...
CVE-2024-42105
CVE-2024-42105 – nilfs2 inode range/UAF fixes in Linux kernel : The referenced security issue is mitigated by a patch series for nilfs2 that fixes a use-after-free and several inode-number range problems. Specifically, nilfs->ns_first_ino (the first non-reserved inode) was read from the superb...
CVE-2024-42153
The CVE CVE-2024-42153 affects the Linux kernel I2C pnx driver, where del_timer_sync() invoked from an ISR could emit a deadlock warning. The fix replaces del_timer_sync() with wait_for_completion_timeout() in isr, allowing removal of the timer and related code. This change removes the warning an...
CVE-2024-42285
CVE-2024-42285 affects the Linux kernel RDMA/iwcm subsystem. The issue is a use-after-free involving destroying CM IDs: a newly allocated rdma_id_private (conn_id) is linked to an existing iw_cm_id (cm_id) and used to set cm_id->context and cm_id->cm_handler, while rdma_destroy_id() frees b...
CVE-2024-42310
CVE-2024-42310 concerns a null pointer dereference in the Linux kernel's DRM GMA500 driver, specifically cdv_intel_lvds_get_modes. The bug arises when the return value of drm_mode_duplicate() is assigned to mode and drm_mode_duplicate() fails, potentially leading to an NPD. The issue has been fix...
CVE-2024-43824
The CVE CVE-2024-43824 affects the Linux kernel PCI Express endpoint code (pci_epf_test). The vulnerability arises from use of cached epc_features in pci_epf_test_core_init() instead of querying via pci_epc_get_features(), removing a NULL check that was deemed redundant. The change relies on epc_...
CVE-2024-44959
CVE-2024-44959 targets the Linux kernel tracefs subsystem. The issue stems from a race condition in freeing inodes when structure layout randomization is enabled for 'struct inode', which risks overlapping RCU-used or one-time-initialized members (e.g., i_lru, i_sb_list) and can corrupt related l...
CVE-2024-44983
CVE-2024-44983 affects the Linux kernel (netfilter: flowtable: validate vlan header). The root cause is insufficient room/bounds checking to access the VLAN header protocol field, risking an improper flowtable lookup. The fix validates the VLAN header before using it in the flowtable lookup, with...
CVE-2024-46691
CVE-2024-46691 affects the Linux kernel USB Type-C UCSI path. The unregister path (ucsi_unregister) moved to be called from atomic context due to a PMIC_GLINK/IRq-callback spinlock change, making sleepable code paths (unregister) unsafe. This creates a potential flaw where unregistration can occu...
CVE-2024-46719
CVE-2024-46719 (Linux kernel) addresses a NULL pointer dereference in the USB Type-C UCSI code. The root cause is that ucsi_register_altmode considers NULL a valid alt pointer and, when CONFIG_TYPEC_DP_ALTMODE is disabled, ucsi_register_displayport can return NULL, leading to a NULL pointer deref...
CVE-2024-46755
CVE-2024-46755 concerns the Linux kernel wifi mwifiex driver. The issue arises from mwifiex_get_priv_by_id() returning priv pointers for a given bss_num/bss_type without verifying that the priv is currently in use; unused priv pointers lack an attached wiphy, which can lead to a NULL pointer dere...
CVE-2024-46843
CVE-2024-46843 concerns the Linux kernel SCSI/UFS path. The issue arises when removing the ufshcd driver from a UFS device, potentially causing a kernel panic if ufshcd_async_scan fails during ufshcd_probe_hba before a SCSI host is added. The fix is to guarantee the SCSI host is removed only if i...
CVE-2024-46851
The CVE-2024-46851 issue appears in the Linux kernel DRM/AMD display code: a race between dcn10_set_drr() and dc_state_destruct() can occur if dc_state_destruct() nulls the DC state resource context while IRQ processing calls dcn10_set_drr(). The pipe context passed to dcn10_set_drr() is part of ...
CVE-2024-47714
CVE-2024-47714 affects the Linux kernel Wi-Fi driver for MT76/MT7996. The root cause is using hweight8 on a u16 chainmask, which yields an incorrect tx_ant; a patch switches to hweight16 to compute the correct tx antenna. Without the fix, tx_ant on band 2 could be -1, leading to a KASAN: stack-ou...
CVE-2024-50000
CVE-2024-50000 affects the Linux kernel mlx5e driver: in mlx5e_tir_builder_alloc(), kvzalloc() may return NULL and the code dereferences it, causing a NULL pointer dereference. The vulnerability is fixed by the upstream patch in the Linux kernel; remediation is to upgrade to a version containing ...