CVE-2025-21707

CVE-2025-21707 affects the Linux kernel MPTCP implementation. The issue stems from how MPTCP maintains received suboption status as a bitmask and per-suboption info. Zeroing the status bitmask on parse isn’t sufficient; some per-suboption bitfields aren’t cleared/initialized for certain parsed su...

CVE-2024-42318

CVE-2024-42318: In the Linux kernel, Landlock loses track of its restrictions when cred are replaced due to missing cred_transfer hook. The special case KEYCTL_SESSION_TO_PARENT uses cred_transfer, while Landlock implements only cred_prepare, causing Landlock restrictions to be dropped and enabli...

CVE-2024-43831

The CVE-2024-43831 vulnerability affects the Linux kernel media/mediatek/vcodec path, specifically the vpu_dec_init function where an invalid decoder VSI could be mishandled. The fix, as documented, ensures the decoder VSI is valid for future use, reducing the risk of exploitation. The issue is c...

CVE-2024-44977

In CVE-2024-44977, the Linux kernel module drm/amdgpu is affected by a missing TA binary size validation that could allow an out-of-bounds write. The issue is resolved by adding TA binary size validation to the TA handling path. The fix was cherry-picked from commit c0a04e3570d72aaf090962156ad085...

CVE-2024-44983

CVE-2024-44983 affects the Linux kernel (netfilter: flowtable: validate vlan header). The root cause is insufficient room/bounds checking to access the VLAN header protocol field, risking an improper flowtable lookup. The fix validates the VLAN header before using it in the flowtable lookup, with...

CVE-2024-44996

The CVE-2024-44996 issue affects the Linux kernel vsock path when a vsock socket is added to a BPF sockmap. The bug arises when prot->recvmsg is replaced by vsock_bpf_recvmsg(), creating a recursive call chain: vsock_bpf_recvmsg() -> __vsock_recvmsg() -> vsock_connectible_recvmsg() ->...

CVE-2024-46691

CVE-2024-46691 affects the Linux kernel USB Type-C UCSI path. The unregister path (ucsi_unregister) moved to be called from atomic context due to a PMIC_GLINK/IRq-callback spinlock change, making sleepable code paths (unregister) unsafe. This creates a potential flaw where unregistration can occu...

CVE-2024-46896

The CVE-2024-46896 vulnerability is in the Linux kernel DRM/AMDGPU path. It stems from a memset in drm_sched_job_init() that overwrites the initialized base.sched field in amdgpu_job_alloc, causing a CS validation path to be rejected with a bogus ring and potentially a crash. The fix passes NULL ...

CVE-2024-47714

CVE-2024-47714 affects the Linux kernel Wi-Fi driver for MT76/MT7996. The root cause is using hweight8 on a u16 chainmask, which yields an incorrect tx_ant; a patch switches to hweight16 to compute the correct tx antenna. Without the fix, tx_ant on band 2 could be -1, leading to a KASAN: stack-ou...

CVE-2024-47734

CVE-2024-47734: In the Linux kernel, the bonding subsystem fixed unnecessary warnings/logs from bond_xdp_get_xmit_slave(). The patch removes a WARN_ON_ONCE() and adds rate limiting to netdev_err() to reduce log noise when XDP is used on bonded interfaces (e.g., with bond1 xdpdrv and bond0/slave v...

CVE-2024-49857

CVE-2024-49857 affects the Linux kernel WiFi stack (iwlwifi, mvm) where the cipher pointer is dereferenced without being initialized, causing a NULL pointer dereference. The vulnerability is fixed by setting the cipher parameter before dereferencing, thereby preventing the crash/possible impact d...

CVE-2024-49926

CVE-2024-49926 affects the Linux kernel’s rcu-tasks path (rcu_tasks_need_gpcb). The root cause is an access to a non-existent percpu rtpcp variable when CONFIG_FORCE_NR_CPUS=y, causing nr_cpu_ids to resolve to NR_CPUS instead of the number of possible CPUs, which can lead to a kernel page fault a...

CVE-2024-49953

CVE-2024-49953 affects the Linux kernel mlx5e driver (IPsec path). The issue is a crash caused by calling __xfrm_state_delete() twice: in xfrm_state_delete the km.state is not checked in the driver’s delayed work, which can allow xfrm_state_check_expire() to reset a state that is already XFRM_STA...

CVE-2024-50285

The CVE-2024-50285 issue affects the ksmbd component of the Linux kernel. When a client sends simultaneous SMB requests to ksmbd, memory can be exhausted via the ksmbd_work_cache, leading to an Out-Of-Memory condition. The root cause is insufficient handling of concurrent SMB operations despite a...

CVE-2024-50292

CVE-2024-50292: Linux kernel ASoC stm32_spdifrx DMA channel release bug. If ctrl_chan DMA request fails and ctrl_chan is non-NULL, releasing the DMA channel can dereference a NULL pointer, leading to a kernel NULL dereference. The fix releases the channel only when the pointer is valid (non-NULL)...

CVE-2024-50295

CVE-2024-50295 : In the Linux kernel, the arc net driver fix addresses a DMA mapping issue where ndev->dev and pdev->dev may not be the same device. The correct device used for dma_map_single/dma_unmap_single is ndev->dev.parent, since ndev->dev.parent has the dma_mask, whereas ndev-&...

CVE-2024-53077

CVE-2024-53077 affects the Linux kernel rpcrdma subsystem, specifically the rpcrdma_device xa_array. The root cause is that xa_init_flags() in rpcrdma_add_one() may allocate memory in the xarray that is not released during removal because there is no matching xa_destroy() in rpcrdma_remove_one()....

CVE-2024-53212

CVE-2024-53212 is a Linux kernel vulnerability where a false positive warning in netlink extack could occur during dumps. The fix reworks the validation by using the netlink message header (nlh) instead of scanning skb->data, addressing a scenario where a dump is initiated but not completed du...

CVE-2024-54456

CVE-2024-54456 : Linux kernel NFS path vulnerability in nfs_sysfs_link_rpc_client() leading to potential buffer overflow due to strcat on cl_program->name; fix replaces with strscpy() and strncat() (kernel-side patch). Affected: Linux kernel NFS subsystem; root cause: unbounded name field size...

CVE-2024-58034

CVE-2024-58034 in the Linux kernel fixes an OF node reference bug in memory: tegra20-emc. The issue arises when tegra_emc_find_node_by_ram_code() releases some device nodes while still in use, potentially causing use-after-free (UAF). The description states that the emc-tables node is a child wit...

CVE-2024-58080

CVE-2024-58080 is a Linux kernel issue in the QCOM clock framework (dispcc-sm6350). The root cause is a missing parent_map for clk_rcg2 when it has a parent, which can lead to a NULL pointer dereference during clk_set_rate. The provided description shows a call trace and explains that the fix add...

CVE-2025-21720

CVE-2025-21720 : Linux kernel xfrm: delete intermediate secpath entry in packet offload mode. When IP forwarding is enabled, secpath may not be removed, causing offloaded packets to re-enter the TX path with xfrm_offload set and can trigger a kernel NULL pointer dereference kernel panic in mlx5. ...

CVE-2025-21723

Summary (CVE-2025-21723) In the Linux kernel, mpi3mr/scsi code was fixed to prevent a crash when BSG setup fails. If bsg_setup_queue() fails, bsg_queue may be non-NULL, causing mpi3mr_bsg_exit() to skip bsg_remove_queue() and trigger a NULL pointer dereference (kernel crash) as shown in the entry...

CVE-2025-21870

CVE-2025-21870 affects the Linux kernel ASoC: SOF ipc4-topology. Root cause: when non-DAI copier widgets share the same stream name as the ALH copier, copier->data can be NULL, risking a NULL pointer dereference. The patch/mitigation described hardens the matching logic by ensuring two conditi...

CVE-2025-22106

CVE-2025-22106 affects the Linux kernel vmxnet3 driver. The root cause was that vmxnet3 did not unregister xdp_rxq_info in vmxnet3_reset_work(), because vmxnet3_rq_destroy() was not invoked in that path. The fix moves the unregister code from vmxnet3_rq_destroy() to vmxnet3_rq_cleanup(), preventi...

CVE-2025-22109

CVE-2025-22109 concerns the AX25 autobind feature in the Linux kernel. The linked debugging output shows memory leaks and refcount leaks in ax25_connect() and ax25_release() when autobind is used, caused by refcounts not being incremented as in ax25_bind()/ax25_setsockopt(SO_BINDTODEVICE). The fi...

CVE-2025-37874

CVE-2025-37874 is a Linux kernel vulnerability affecting the ngbe driver (net: ngbe). The issue is a memory leak in ngbe_probe() error paths after ngbe_sw_init(), where memory allocated for wx->rss_key in wx_init_rss_key() was not freed on error, and a double-free risk could occur if mac_table...

CVE-2025-37968

CVE-2025-37968 (Linux kernel) affects the iio: light: opt3001 driver. The issue is a deadlock in a threaded IRQ path caused by reading the same flag twice (once for mutex_lock, once for mutex_unlock). The fix standardizes the flag handling by reading it into a local variable and reusing that valu...

CVE-2025-38180

Summary: CVE-2025-38180 affects the Linux kernel’s ATM /proc net handling (lec). The root cause is unsafe dev_lec[] changes paired with missing dev_hold() before dev_put(), causing an imbalance and use-after-free (UAF). The issue is tied to the net/atm/lec handling code and has been addressed by ...

CVE-2026-31532

CVE-2026-31532 affects the Linux kernel’s raw CAN socket implementation. A use-after-free can occur when, during unregistration of CAN receive filters, the kernel defers receiver deletion with RCU and frees per-CPU storage ro->uniq too early in raw_release(). The fix moves free_percpu(ro->u...

CVE-2002-0510

CVE-2002-0510 describes a fingerprinting flaw in the UDP/IP stack of Linux 2.4.x: the IP Identification field is kept at 0 for non-fragmented packets, enabling remote observers to determine if a target runs Linux. The available connected documents reiterate the Linux kernel vulnerability and refe...

CVE-2010-0307

CVE-2010-0307 affects the Linux kernel (x86_64) prior to 2.6.32.8 where load_elf_binary in fs/binfmt_elf.c may call SET_PERSONALITY before confirming the ELF interpreter exists, enabling a local DoS via a 32-bit process launching a 64-bit one and triggering a segmentation fault (flush_old_exec re...

CVE-2010-3849

CVE-2010-3849 affects the Linux kernel’s econet_sendmsg path (net/econet/af_econet.c) prior to 2.6.36.2, when an Econet address is configured. A local user can trigger a denial of service by issuing a sendmsg with a NULL remote address, causing a NULL pointer dereference and OOPS. The correspondi...

CVE-2010-4346

The vulnerability CVE-2010-4346 affects the Linux kernel: install_special_mapping in mm/mmap.c before 2.6.37-rc6 does not call security_file_mmap as expected, allowing local users to bypass mmap_min_addr restrictions and potentially trigger NULL pointer dereference via a crafted assembly-language...

CVE-2011-1079

The CVE-2011-1079 issue affects the Linux kernel up to version 2.6.38 (before 2.6.39) in the bnep_sock_ioctl path (net/bluetooth/bnep/sock.c). A local attacker could exploit inadequate termination of a device field (missing trailing NUL) via a BNEPCONNADD command to read kernel stack memory and p...

CVE-2012-6638

CVE-2012-6638 (Linux kernel) affects the tcp_rcv_state_process in net/ipv4/tcp_input.c and can cause a DoS due to a flood of SYN+FIN packets. The vulnerability exists in kernels before 3.2.24 and is fixed in the 3.2.24 update (per ChangeLog-3.2.24). Exploitation is described as remote and results...

CVE-2013-4162

CVE-2013-4162 : In the Linux kernel (IPv6 UDP implementation), the function udp_v6_push_pending_frames in net/ipv6/udp.c calls an incorrect function for pending data. This yields a local denial of service (BUG and system crash) when a crafted application uses UDP_CORK via setsockopt. Affected ver...

CVE-2013-4247

CVE-2013-4247: Off-by-one error in the Linux kernel fs/cifs/connect.c build_unc_path_to_root function (vulnerable before 3.9.6) can be triggered by a DFS share mount to cause memory corruption and system crash (Denial of Service). Multiple connected advisories (Unity Linux NES/USN entries and Ora...

CVE-2013-6383

The CVE-2013-6383 issue is real in the Linux kernel up to version 3.11.7: the aac_compat_ioctl function in drivers/scsi/aacraid/linit.c does not require CAP_SYS_RAWIO, allowing local users to bypass access restrictions via a crafted ioctl. Affected: Linux kernel prior to 3.11.8 (notably seen in a...

CVE-2014-8884

CVE-2014-8884 describes a stack-based buffer overflow in the Linux kernel before 3.17.4, specifically in the ttusbdecfe_dvbs_diseqc_send_master_cmd function (drivers/media/usb/ttusb-dec/ttusbdecfe.c). A large ioctl message length can allow local users to cause a system crash (DoS) or potentially ...

CVE-2014-9090

CVE-2014-9090 affects the Linux kernel up to 3.17.4, where do_double_fault in arch/x86/kernel/traps.c mishandles SS fault conditions, allowing local users to cause a denial of service (panic) via modify_ldt (demonstrated by sigreturn_32 in linux-clock-tests). The issue was addressed by a patch li...

CVE-2015-8575

CVE-2015-8575: In Linux kernel

CVE-2016-8636

The CVE-2016-8636 issue affects the Linux kernel’s mem_check_range path in drivers/infiniband/sw/rxe/rxe_mr.c, where an integer overflow can occur. This vulnerability in Soft RoCE (RDMA over InfiniBand) allows local users to trigger memory corruption, potentially cause a denial of service, and ma...

CVE-2017-5123

CVE-2017-5123 is a Linux kernel local privilege-escalation vulnerability in the waitid path. The waitid handler in kernel/exit.c writes to user memory by calling unsafe_put_user without performing an access_ok() check, and without wrapping user-space writes in the required user_access_begin()/use...

CVE-2020-35513

CVE-2020-35513 describes a flaw in the Linux kernel NFS implementation where an incorrect umask during file/directory modification can be triggered when NFSv4.2 and a non-NFSv4.2 process access the NFS concurrently. The result is resource starvation leading to denial of service. The initial and c...

CVE-2021-47023

CVE-2021-47023 is rejected/not used and not an active vulnerability entry.

CVE-2021-47162

CVE-2021-47162 summary (Linux kernel TIPC): The issue in tipc_bufAppend() could cause use-after-free crashes when a frag skb is appended to a frag_list that is shared by multiple skbs. The fix linearizes the head skb (skb_linearize) before skb_unshare() to ensure the appended fragment is only see...

CVE-2021-47202

Summary (concrete details from connected docs): CVE-2021-47202 affects the Linux kernel’s thermal subsystem. The vulnerability arises in of_parse_thermal_zones(), which registers a thermal_zone for each subnode of thermal-zones. If a thermal zone uses a thermal sensor whose device has not yet pro...

CVE-2021-47203

CVE-2021-47203 concerns the Linux kernel SCSI lpfc driver. The description details a corruption in the lpfc_drain_txq() path where, if an adapter send fails, a local fail_msg is set and jobs are added to a completions list. Processing of subsequent jobs continues, and because fail_msg remains set...

CVE-2021-47633

CVE-2021-47633 is described in connected documents as a Linux kernel flaw in the ath5k driver where, during EEPROM parsing (ath5k_eeprom_read_pcal_info_5111), an out-of-bounds write could occur when no curve is selected in a loop, allowing idx to reach AR5K_EEPROM_N_PD_CURVES and causing pd to be...