CVE-2023-52504

CVE-2023-52504 affects the Linux kernel (x86/alternatives) where KASAN can misbehave when apply_alternatives() patches CPU LA57-related features on 5-level paging systems. The issue arises because KASAN_SHADOW_START is derived from __VIRTUAL_MASK_SHIFT, which depends on cpu_feature_enabled(), lea...

CVE-2023-52812

CVE-2023-52812 affects the Linux kernel in the DRM/AMD path for updating PCIe parameters in SR-IOV environments. The root cause is that pcie_table->num_of_link_levels can be 0, making num_of_levels − 1 evaluate to an invalid index and potentially causing an out-of-bounds access. The vulnerabil...

CVE-2023-53077

CVE-2023-53077 affects the Linux kernel’s DRM AMD display path. The vulnerability arises in CalculateVMAndRowBytes when PTEBufferSizeInRequests is zero, causing UBSAN to warn due to dml_log2 returning an unexpectedly negative value (shift exponent 4294966273). The documented fix is to skip the dm...

CVE-2024-35815

CVE-2024-35815: In the Linux kernel, a vulnerability in fs/aio arose because the first kiocb_set_cancel_fn() argument could point to a struct kiocb not embedded in struct aio_kiocb, causing req->ki_ctx to be read around the IOCB_AIO_RW test depending on compiler behavior. The fix guarantees th...

CVE-2024-35922

The CVE-2024-35922 issue is a Linux kernel vulnerability in fbmon/fb_videomode_from_videomode() where htotal * vtotal can overflow to zero, risking division by zero. The root cause is overflow during videomode computation; the fix mirrors fb_var_to_videomode() by preventing division by zero. Affe...

CVE-2024-35936

CVE-2024-35936. In the Linux kernel, the btrfs relocation code (btrfs_relocate_sys_chunks) contains an unhandled corruption case in its chunk-tree lookup loop. The issue arises from two theoretically impossible conditions: (1) an inexact search yields a key with offset -1 for a chunk-tree item, a...

CVE-2024-36478

CVE-2024-36478 affects the Linux kernel null_blk driver. The issue is a NULL pointer dereference that occurs when power and submit_queues are configured concurrently, leading to a kernel panic via a race between del_gendisk and NR HW queue updates. The fixes consolidate protection by reusing a gl...

CVE-2024-38602

The CVE-2024-38602 issue is in the Linux kernel ax25 subsystem, where a reference-count leak on the ax25_dev object was reported. The root causes are: (1) ax25_addr_ax25dev() could increase ax25_dev’s refcount multiple times, risking a memory leak, and (2) ax25_dev_device_down() could drop the re...

CVE-2024-38634

CVE-2024-38634 affects Linux kernel serial/max3100: a race occurs when uart_handle_cts_change() runs from a workqueue without holding port->lock, risking a kernel warning and potential crash. The fix enforces taking port lock before calling uart_handle_cts_change(), preventing the splat observ...

CVE-2024-39371

CVE-2024-39371 affects the Linux kernel io_uring path. The issue arises in io_file_can_poll() when a forced ASYNC request has a bad or unassigned file descriptor, potentially triggering a NULL pointer dereference via the forced async preparation path. The vulnerability is demonstrated in the trac...

CVE-2024-39468

CVE-2024-39468 affects the Linux kernel CIFS/SMB client: a deadlock in smb2_find_smb_tcon() can occur due to holding the cifs_tcp_ses_lock when invoking cifs_put_smb_ses(). The fix releases/correctly unlocks cifs_tcp_ses_lock before calling cifs_put_smb_ses(), avoiding the deadlock. References in...

CVE-2024-39495

The CVE-2024-39495 issue is a Linux kernel use-after-free in greybus gb_interface_release caused by a race with gb_interface_mode_switch_work. The fix, confirmed by multiple sources (e.g., Astra Linux advisory reflecting the same description), is to cancel the scheduled work before freeing the ob...

CVE-2024-41002

The connected documents confirm CVE-2024-41002 affects the Linux kernel crypto path for Hisilicon SEC (AIV resource) where releasing SEC resources could leak memory. The root cause is improper synchronization of AIV release with sec resource cleanup, leading to a memory leak when resources are fr...

CVE-2024-41075

CVE-2024-41075 affects the Linux kernel cachefiles subsystem. The vulnerability arises in copen/cread handling, where insufficient consistency checks could permit a malicious process to complete arbitrary open/read requests, potentially crashing the system. The fixed approach adds explicit checks...

CVE-2024-42097

CVE-2024-42097 corresponds to a Linux kernel issue in ALSA emux patch handling where load_data() validation and skipping of the main info block was not aligned with load_guspatch(), and load_guspatch() lacked a check that the patch length matches the data. The connected Nessus entries confirm the...

CVE-2024-44948

The CVE-2024-44948 entry applies to the Linux kernel vulnerability where mtrr_save_state() did not verify the fixed MTRR capability bit before accessing fixed MTRR MSRs. This missing capability check could cause a #GP on older CPUs that lack the fixed MTRR capability, though the RDMSR fault would...

CVE-2024-45008

CVE-2024-45008 affects the Linux kernel input subsystem. The vulnerability arises when input_mt_init_slots() allocates slots based on user-supplied num_slots via UI_DEV_CREATE, risking oversized allocations. A patch caps the maximum slots at 1024, mitigating memory exhaustion. Connected advisorie...

CVE-2024-45015

CVE-2024-45015 affects the Linux kernel component drm/msm/dpu. The vulnerability arises when crtc connectors_changed is set without a corresponding atomic_mode_set(), leading to an atomic_enable() followed by atomic_disable() without re-assigning the connector, causing NULL pointer dereference in...

CVE-2024-46719

CVE-2024-46719 (Linux kernel) addresses a NULL pointer dereference in the USB Type-C UCSI code. The root cause is that ucsi_register_altmode considers NULL a valid alt pointer and, when CONFIG_TYPEC_DP_ALTMODE is disabled, ucsi_register_displayport can return NULL, leading to a NULL pointer deref...

CVE-2024-46802

CVE-2024-46802 affects the Linux kernel’s DRM-AMD display path. The vulnerability is a NULL-dereference in drm/amd/display when validating a stream, caused by missing NULL checks for dc or stream. The fixed code adds a NULL check at the start of dc_validate_stream to prevent invalid memory access...

CVE-2024-46832

CVE-2024-46832 involves the Linux kernel, specifically the MIPS cevt-r4k path. The issue arose when get_c0_compare_int was called if a timer IRQ was installed, which could trigger a WARN/BUG: sleeping function called from invalid context on secondary CPU. The patch changes the flow to avoid calli...

CVE-2024-46870

CVE-2024-46870 concerns the Linux kernel’s DRM/AMD display path, where a race condition can occur in DCN35 when DMCUB timeout is not appropriate. The provided description states that DMCUB can take longer to process commands, and the old ASIC policy could continue after a diagnostic error, riskin...

CVE-2024-47665

CVE-2024-47665 concerns the Linux kernel’s i3c: mipi-i3c-hci driver. The bug manifested during IBI DMA setup when the code checked if dma_get_cache_alignment * defined value > 256, and incorrectly BUG_ON()'ed during driver initialization. The vulnerability could cause a local fault due to a fa...

CVE-2024-47732

The Connected documents confirm CVE-2024-47732 affects the Linux kernel and concerns a potential use-after-free in crypto: iaa (free_device_compression_mode freeing device_mode, which is later passed to iaa_compression_modes[i]->free()). The OSV entries summarize the vulnerability as resolved ...

CVE-2024-49864

CVE-2024-49864 (Linux kernel, rxrpc) : A race existed between rxrpc_open_socket() creating the UDP socket and the I/O thread that handles it, allowing a UDP packet to arrive at rxrpc_encap_rcv() before the I/O thread exists, which could cause an oops when waking the not-yet-created thread. The qu...

CVE-2024-49871

CVE-2024-49871 affects the Linux kernel adp5589-keys driver. A NULL pointer dereference can occur because i2c_set_clientdata() is only called at the end of probe, while the code passes the i2c client to i2c_get_clientdata() during early failure of probe. The connected document confirms a resolved...

CVE-2024-49953

CVE-2024-49953 affects the Linux kernel mlx5e driver (IPsec path). The issue is a crash caused by calling __xfrm_state_delete() twice: in xfrm_state_delete the km.state is not checked in the driver’s delayed work, which can allow xfrm_state_check_expire() to reset a state that is already XFRM_STA...

CVE-2024-50157

CVE-2024-50157 concerns the Linux kernel RDMA/bnxt_re driver. The root cause is a loop waiting for the FIFO occupancy to drop below a threshold; under high pacing interrupts, this can cause a soft lockup on a processor. The fix adds a loop counter for FPGA and exits __wait_for_fifo_occupancy_belo...

CVE-2024-50161

CVE-2024-50161 refers to a Linux kernel vulnerability in the BPF/C API: when repeating BTF fields for an array of nested structs, the code failed to validate the remaining info_cnt, causing a UBSAN array-index-out-of-bounds condition (index 11 out of range for btf_field_info[11]). Affected compon...

CVE-2024-50238

CVE-2024-50238 affects the Linux kernel Qualcomm qmp-usb/qmp-usbc drivers. The issue was a NULL-pointer dereference during runtime suspend caused by removing the initialisation of platform driver data in probe, after a commit cleaned up probe initialisation. The bug reproduced when the driver was...

CVE-2024-50285

CVE-2024-50285 affects ksmbd in the Linux kernel. The issue occurs when a client issues simultaneous SMB operations, which can exhaust memory via ksmbd_work_cache and cause an OOM. A patch adds a check against exceeding max credits, treating each SMB request as consuming at least one credit to pr...

CVE-2024-50286

CVE-2024-50286 describes a slab-use-after-free race in the Linux kernel’s ksmbd subsystem, between ksmbd_smb2_session_create and ksmbd_expire_session. The patch adds the missing sessions_table_lock when adding/deleting a session from the global session table, addressing the race. The issue is roo...

CVE-2024-50294

CVE-2024-50294 affects the Linux kernel (rxrpc subsystem). The issue arises when a call is aborted between queuing for connection and the I/O thread handling it, causing a race where the abort may be prioritized and the call removed from local->new_client_calls by rxrpc_disconnect_client_call(...

CVE-2024-53143

CVE-2024-53143 affects the Linux kernel’s fsnotify path, fixing an ordering issue where iput() must complete before decrementing the watched_objects count. The patch ensures the superblock remains alive until iput() is done, preventing a potential use-after-free (UAF) of sb->s_fs_info in tmpfs...

CVE-2024-57872

CVE-2024-57872 – Linux kernel vulnerability affecting the SCSI/ufs path. The issue is caused by not releasing the HBA during ufshcd_pltfrm_remove(), which can lead to memory leaks. The fix ensures proper cleanup by calling scsi_host_dev_release() to free the HBA and avoid leaks. The CVE is rated ...

CVE-2025-21829

CVE-2025-21829 affects the Linux kernel RDMArxe; a warning in __rxe_cleanup and rxe resource handling could cause improper resource release under high rdma load. The issue is resolved by a kernel fix that increases the timeout for rdma resource teardown, with commits in the stable/rxe flow (examp...

CVE-2025-21937

CVE-2025-21937 (Linux kernel) : The vulnerability concerns a NULL dereference in Bluetooth mgmt_remote_name() from an unchecked mgmt_alloc_skb() return value. The fix adds a check for mgmt_alloc_skb() and validates its return value in mgmt_remote_name(), mitigating the issue. Connected advisories...

CVE-2025-22025

CVE-2025-22025: In the Linux kernel NFS server (nfsd), if nfsd4_run_cb fails while queuing a dl_recall, the incremented dl_stid reference is not decremented, causing a potential dl_stid leak. The issue is addressed by checking the result of nfsd4_run_cb and, on failure, calling nfs4_put_stid to p...

CVE-2025-22042

CVE-2025-22042 pertains to the Linux kernel’s ksmbd subsystem. The issue was a missing bounds check in the creation of a lease context within ksmbd, which could lead to out-of-bounds conditions. The connected documents confirm that this bound-check was added/fixed in the kernel to resolve the vul...

CVE-2025-37793

CVE-2025-37793 affects the Linux kernel ASoC: Intel avs driver. The vulnerability arises when avs_component_probe() dereferences a NULL from devm_kasprintf() if memory allocation fails, leading to a NULL pointer dereference. A fix was implemented in the kernel to check for NULL from devm_kasprint...

CVE-2025-37852

CVE-2025-37852 affects the Linux kernel DRM/AMDGPU stack. The root cause is errors from amdgpu_cgs_create_device() in amd_powerplay_create(), which could lead to a null pointer dereference if not handled. The fix propagates the failure to the caller, releases the hwmgr, and returns -ENOMEM instea...

CVE-2025-37864

CVE-2025-37864 relates to the Linux kernel DSA subsystem: a cleanup path for FDB, MDB and VLAN entries on unbind was added to fix a scenario where bridge bypass operations could leave stale entries and trigger a leak/warn on unbind. The vulnerability stems from the assumption that higher layers b...

CVE-2025-37873

The CVE-2025-37873 entry concerns the Linux kernel Ethernet driver for Broadcom/BNXT (eth: bnxt). The issue arises in the Tx path after a conversion to a free-running tx_prod, where masking on the Tx error path was missed, causing a crash on error conditions such as DMA mapping failures. The root...

CVE-2025-37891

The provided documents confirm CVE-2025-37891 affects the Linux kernel’s ALSA: ump path, where SysEx messages could overflow an internal 4-byte buffer during MIDI 1.0 to UMP conversion. The root cause is that SysEx can be up to 6 bytes, exceeding the original 4-byte buffer, risking memory corrupt...

CVE-2025-37958

CVE-2025-37958 affects the Linux kernel THP path. The issue arises when migrating a THP: concurrent access to the PMD migration entry during a deferred split scan could dereference an invalid address. The fix adds a check of the PMD migration entry and returns early, since the PMD migration entry...

CVE-2025-38499

The CVE concerns the Linux kernel and the clone_private_mnt() path. The root cause is a missing CAP_SYS_ADMIN check in the correct user namespace during mount handling, which could allow exposure of something hidden by a mount that cannot be undone. The issue is tied to how CAP_SYS_ADMIN is check...

CVE-2025-39778

Technical details about CVE-2025-39778 (affected product, impact, and fix specifics) are not provided in the connected documents. Monitor for official disclosures and vendor advisories for updates and patch information.

CVE-2010-4165

CVE-2010-4165 affects the Linux kernel prior to 2.6.37-rc2. The do_tcp_setsockopt function does not properly constrain TCP_MAXSEG (MSS) values, allowing a local user to trigger a denial of service via a setsockopt with a small value, leading to a divide-by-zero or signed-integer misuse. Evidence ...

CVE-2010-4251

CVE-2010-4251 affects the Linux kernel up to version 2.6.34. The vulnerability lies in the socket backlog handling in net/core/sock.c, which allows remote attackers to cause memory exhaustion DoS by sending大量 network traffic (e.g., UDP via netperf). The issue is addressed by the 2.6.34 changelog ...

CVE-2011-0726

The CVE-2011-0726 entry is supported by connected advisories describing a Linux kernel vulnerability in do_task_stat (fs/proc/array.c) present in kernels before 2.6.39-rc1. The flaw allows local users to defeat ASLR by reading start_code/end_code from /proc/[pid]/stat for PIE processes, implying ...