CVE-2010-4251

CVE-2010-4251 affects the Linux kernel up to version 2.6.34. The vulnerability lies in the socket backlog handling in net/core/sock.c, which allows remote attackers to cause memory exhaustion DoS by sending大量 network traffic (e.g., UDP via netperf). The issue is addressed by the 2.6.34 changelog ...

CVE-2011-0726

The CVE-2011-0726 entry is supported by connected advisories describing a Linux kernel vulnerability in do_task_stat (fs/proc/array.c) present in kernels before 2.6.39-rc1. The flaw allows local users to defeat ASLR by reading start_code/end_code from /proc/[pid]/stat for PIE processes, implying ...

CVE-2012-1097

CVE-2012-1097 affects the Linux kernel before 3.2.10, where the regset (register set) path mishandles absence of .get/.set methods. This can allow a local attacker to trigger a NULL pointer dereference via PTRACE_GETREGSET or PTRACE_SETREGSET, possibly causing denial of service or other impact. R...

CVE-2014-1446

CVE-2014-1446 affects the Linux kernel up to version 3.12.7, where the yam_ioctl handler in drivers/net/hamradio/yam.c fails to initialize a structure member. This can allow a local attacker with CAP_NET_ADMIN to leak kernel memory via an SIOCYAMGCFG ioctl, enabling information disclosure. The ex...

CVE-2014-7826

CVE-2014-7826 affects the Linux kernel up to 3.17.2, where kernel/trace/trace_syscalls.c in the ftrace subsystem mishandles private syscall numbers. This can allow a local user to gain privileges or cause a denial of service via an crafted application (invalid pointer dereference). Connected advi...

CVE-2017-18224

CVE-2017-18224 : The Linux kernel before 4.15 contains a race condition in the ocfs2 extent-tree path. Specifically, in fs/ocfs2/aops.c, a semaphore is omitted during read operations in DIRECT mode, enabling a local attacker to trigger a denial of service by modifying the e_cpos field. The connec...

CVE-2019-15791

CVE-2019-15791 describes a refcount underflow in the Linux kernel shiftfs implementation caused by a non-upstream patch in Ubuntu 5.0/5.3 kernels: shiftfs_btrfs_ioctl_fd_replace() can create a file descriptor to a lower-filesystem file without an extra reference, and closing the FD after the btrf...

CVE-2021-46997

CVE-2021-46997 is rejected/not used; not an active vulnerability entry.

CVE-2021-47119

CVE-2021-47119 (Linux kernel/ext4) involves a memory leak in ext4_fill_super where buffer head references (and the page referenced by b_data) are not freed by kill_bdev. The issue arises when block sizes differ: sb_set_blocksize() kills current buffers/page cache via kill_bdev and then rereads th...

CVE-2022-48664

CVE-2022-48664 concerns the Linux kernel, specifically the btrfs filesystem. The issue caused hangs during unmount when a space reclaim worker is stopped, usually observed as a long-blocked umount task in tests (e.g., generic/562). The described sequence shows the cleaner kthread starting a trans...

CVE-2022-48853

The CVE-2022-48853 entry concerns a Linux kernel swiotlb information leak when using DMA_FROM_DEVICE during SCSI SG I/O. The description explains a multi-step scenario where a bounce buffer and swiotlb can expose non-zero data from user space, potentially leaking content when the TUR (Test Unit R...

CVE-2022-48990

CVE-2022-48990 affects the Linux kernel (drm/amdgpu) where a use-after-free could occur during GPU recovery due to fw_fence not being initialized before amdgpu_job_free_cb frees a job. The publicly provided details state the fix is in drm/amdgpu: fix use-after-free during gpu recovery, addressing...

CVE-2022-49168

The CVE-2022-49168 entry concerns a Linux kernel bug in the btrfs repair path. The issue occurred when the repair submission failed and the code attempted to clean up the repair bio simultaneously with endio, creating potential use-after-free and NULL dereference conditions due to racing with bio...

CVE-2022-49188

CVE-2022-49188 affects the Linux kernel remoteproc: qcom_q6v5_mss path, where leaks can occur in q6v5_alloc_memory_region due to improper device_node handling. The root cause is that the device_node pointer returned by of_parse_phandle() or of_get_child_by_name() is not always balanced with of_no...

CVE-2022-49302

CVE-2022-49302 affects the Linux kernel USB host isp116x driver. The vulnerability arises when code fails to check the return value of platform_get_resource(), which can lead to a null pointer dereference if the call returns NULL. The connected documents confirm the issue and state that the fix i...

CVE-2022-49304

CVE-2022-49304 concerns a deadlock in the Linux kernel’s serial driver path (drivers/tty/serial) specifically in sa1100_set_termios(). The issue stems from a lock-order conflict: thread1 holds sport->port.lock while waiting on del_timer_sync(), while a timer handler running in thread2 also nee...

CVE-2022-49314

The CVE-2022-49314 issue is a Linux kernel resource leak in tty/icom_probe: if pci_read_config_dword fails, resources allocated earlier are recycled by pci_release_regions() and pci_disable_device(). The connected Astra Linux advisory reiterates the fix for linux-5.10/5.15 series kernels and mirr...

CVE-2022-49390

The CVE-2022-49390 entry concerns a Linux kernel macsec vulnerability in which a new macsec device could be created without holding a reference to the underlying real_dev, enabling a use-after-free in macsec_get_iflink and related paths. Root cause: lack of proper reference handling for real_dev ...

CVE-2022-49407

CVE-2022-49407 concerns the Linux kernel, in the dlm subsystem, where an invalid read could occur when mis-casting between plock_op and plock_xop structures during lock/file operations. The root cause was a misplacement of a field (the callback) that allowed an unsafe cast, enabling a read of fie...

CVE-2022-49827

Summary (CVE-2022-49827) : In the Linux kernel DRM stack, a possible null pointer dereference could occur during vblank cleanup when __drmm_add_action() fails and drm_vblank_init_release() runs for a vblank with a NULL worker, leading to kthread_destroy_worker() dereference. The fix adds a NULL c...

CVE-2022-49862

CVE-2022-49862 concerns the Linux kernel TIPC subsystem. The issue arises in tipc_nl_compat_name_table_dump_header where the msg->req TLV length is not properly validated, following a prior change intended to fix uninit-value behavior when TLV_GET_DATA_LEN() can be negative. This can lead to i...

CVE-2022-50066

Summary: CVE-2022-50066 affects the Linux kernel’s net/atlantic driver (Aquantia) where the final iteration of a for loop can dereference an out-of-bounds aq_vec entry, causing a UBSAN array-index-out-of-bounds condition. The issue manifests as index 8 being out of range for aq_vec_s *[8] in aq_n...

CVE-2023-0240

CVE-2023-0240 relates to a logic error in Linux kernel io_uring that can trigger a use-after-free, enabling local privilege escalation. Specifically, in io_prep_async_work, the code may incorrectly use the init_cred or a previous identity if the final io_grab_identity returns false, causing refer...

CVE-2023-52584

CVE-2023-52584 refers to a Linux kernel issue in the spmi: mediatek driver where a use‑after‑free occurs on device removal: the pmif driver clocks are freed after spmi_controller, but the clocks are accessed via devres, leading to UAF. The documented fix uses an unmanaged clk_bulk_get() and frees...

CVE-2023-52657

The CVE-2023-52657 entry centers on a Linux kernel revert in the AMD DRM subsystem (drm/amd/pm: resolve reboot exception for si oland), specifically reverting commit e490d60a2f76bff636c68ce4fe34c1b6c34bbd86. Public references describe that this change causes hangs on SI when DC is enabled and int...

CVE-2023-53017

The CVE-2023-53017 entry concerns a memory leak in the Linux kernel Bluetooth stack (hci_sync path). Root cause: in hci_update_adv_data(), if hci_cmd_sync_queue() fails, the allocated inst_ptr was not freed. Mitigation: switch to using ERR_PTR/PTR_ERR to pass the instance to the callback, so no a...

CVE-2023-53018

CVE-2023-53018 affects the Linux kernel Bluetooth stack. If hci_cmd_sync_queue() fails in hci_le_terminate_big() or hci_le_big_terminate(), the memory pointed to by d is not freed, causing a memory leak. A patch adds a release path in the error flow to fix this. Exploitation details are not provi...

CVE-2023-53102

CVE-2023-53102 details (Linux kernel, ice driver). The issue arises in ice_qp_dis() for xsk/xdpsock, where txq interrupts were being disabled before the hardware flush completed, allowing a window where IRQs could fire during a pool detach. The documented bug trace shows a NULL pointer dereferenc...

CVE-2024-26842

The CVE-2024-26842 issue is a Linux kernel vulnerability in the SCSI UFS host controller code (ufshcd_clear_cmd). In MCQ mode, when task_tag >= 32 and sizeof(unsigned int) == 4, 1U <

CVE-2024-26888

CVE-2024-26888 : Linux kernel vulnerability in Bluetooth msft path reported as fixed by a memory leak fix. The issue involved a leaking buffer allocated to send MSFT_OP_LE_MONITOR_ADVERTISEMENT. Public docs confirm the fix; CVSS indicates LOCAL attack vector with low to moderate impact (Base 5.5,...

CVE-2024-27050

Summary (CVE-2024-27050): In the Linux kernel libbpf code, the bpf_xdp_query_opts struct gained fields feature_flags and xdp_zc_max_segs. The code updating these fields did not use the OPTS_SET() macro, causing writes to the fields unconditionally and risking stack corruption for programs built a...

CVE-2024-35998

The CVE-2024-35998 entry corresponds to a Linux kernel fix for a potential deadlock in CIFS (smb3) related to lock ordering in cifs_sync_mid_result. Coverity identified a thread deadlock caused by acquiring TCP_Server_Info.srv_lock while holding TCP_Server_Info.mid_lock. The connected Astra/Tence...

CVE-2024-40980

CVE-2024-40980 affects the Linux kernel where drop_monitor uses a spin_lock in trace_drop_common() executed with preemption disabled, problematic on RT kernels due to sleeping locks in atomic context. The vulnerability can lead to a crash (sleeping function called from invalid context) and potent...

CVE-2024-41022

AFFECTED SOFTWARE: Linux kernel (drm/amdgpu) with a signedness bug in sdma_v4_0_process_trap_irq() where the local error-path handling depended on a signed instance counter. ROOT CAUSE: the instance variable needed to be signed to ensure correct error handling, and failure to do so could affect t...

CVE-2024-42106

CVE-2024-42106 : In the Linux kernel, the inet_diag path for raw sockets could read an uninitialized pad field in inet_diag_req_v2 when converting inet_diag_req to v2, leading to uninitialized reads in raw_lookup(). The root cause is that inet_diag_get_exact_compat() and inet_diag_dump_compat() d...

CVE-2024-42282

The CVE refers to the Linux kernel Mediatek driver: a NULL pointer dereference in dummy_net_device handling was addressed by moving the free_netdev() call from mtk_free_dev() to mtk_remove(), ensuring free_netdev() only runs after a successful mtk_probe() and full allocation of eth->dummy_dev....

CVE-2024-42285

The CVE-2024-42285 entry affects the Linux kernel’s RDMA/iwcm code and describes a use-after-free when destroying CM IDs. The issue originates from how iw_conn_req_handler() associates a new rdma_id_private (conn_id) with an existing iw_cm_id (cm_id): conn_id->cm_id.iw = cm_id; cm_id->conte...

CVE-2024-43841

CVE-2024-43841 affects the Linux kernel wifi/virt_wifi path. The vulnerability allowed a reported successful connection to be reported even when the SSID from user space differed from what virt_wifi advertised, because the SSID was not checked (only BSSID was validated). A fix was implemented in ...

CVE-2024-44985

Summary (CVE-2024-44985) : In the Linux kernel, the IPv6 xmit path (ip6_xmit) could suffer a use-after-free if skb_expand_head() returns NULL, freeing the skb and potentially the associated dst/idev. The issue is mitigated by ensuring RCUs protections (rcu_read_lock()) to prevent the UAF. The Ast...

CVE-2024-46738

CVE-2024-46738 affects the Linux kernel VMCI subsystem. A use-after-free occurs in vmci_resource_remove() when removing a resource from vmci_resource_table if two resources share the same handle (same context and resource fields) but differ by type; the code previously could free the wrong object...

CVE-2024-46843

CVE-2024-46843 concerns the Linux kernel SCSI/UFS path. The issue arises when removing the ufshcd driver from a UFS device, potentially causing a kernel panic if ufshcd_async_scan fails during ufshcd_probe_hba before a SCSI host is added. The fix is to guarantee the SCSI host is removed only if i...

CVE-2024-47686

The CVE-2024-47686 item concerns a Linux kernel vulnerability in the ep93xx clock driver. The root cause is an off-by-one in ep93xx_div_recalc_rate() where the psc->div[] array length (psc->num_div) did not correctly guard reads; the condition must be >= rather than > to prevent an ou...

CVE-2024-47734

CVE-2024-47734: In the Linux kernel, the bonding subsystem fixed unnecessary warnings/logs from bond_xdp_get_xmit_slave(). The patch removes a WARN_ON_ONCE() and adds rate limiting to netdev_err() to reduce log noise when XDP is used on bonded interfaces (e.g., with bond1 xdpdrv and bond0/slave v...

CVE-2024-49865

CVE-2024-49865 affects the Linux kernel’s DRM XE VM code. The root cause is a use-after-free risk caused by the timing of allocating VM IDs with xa_alloc, which allowed an Evil user to guess the next VM id before vm destroy/ioctl completes, potentially exposing references to the same VM that is s...

CVE-2024-49908

CVE-2024-49908: In the Linux kernel, the AMDGPU display driver (amdgpu_dm) had a missing null check for theafb in amdgpu_dm_update_cursor, risking a null pointer dereference. The fix adds a null check and moves the check to the point of use (line where afb is accessed). Affects drm/amd/display co...

CVE-2024-49910

CVE-2024-49910 concerns the Linux kernel DRM/AMD display path. The root cause was a null dereference risk in drm/amd/display's dcn401_set_output_transfer_func: set_output_gamma could be non-null checked, then dereferenced. The fix adds a null check for set_output_gamma before invoking it, elimina...

CVE-2024-49972

CVE-2024-49972 affects the Linux kernel DRM-AMD display path. The issue arises when creating DML memory during DC state changes: if the DML memory allocation fails, previously allocated memory was not deallocated, leaving an uninitialized, non-NULL structure. The documented fix deallocates the me...

CVE-2024-50112

In CVE-2024-50112, the Linux kernel fixes a weakness in Linear Address Masking (LAM) on x86 by disabling LAM in most cases. The vulnerability stems from transient execution risk related to LAM unless Linear Address Space Separation (LASS) is active. Until LASS support lands, LAM should only be al...

CVE-2024-56680

CVE-2024-56680 affects the Linux kernel. The issue stems from IPU6 interrupt handling on shared IRQ lines: when the IPU6 device is disabled, an IRQ can be triggered by another device and ISR_STATUS may read 0xffffffff, risking system hang. The kernel fix adds defensive checks to avoid suspending ...

CVE-2024-56771

CVE-2024-56771 concerns the Linux kernel mtd/spinand/winbond NAND ECC handling. Four WINBOND 3D NAND chips (W25N512GW, W25N01GW, W25N01JW, W25N02JW) rely on a single-bit ECC engine on-die. The issue arises because querying per-chunk bitflips via ->get_status() is unnecessary and unsupported fo...