CVE-2025-21792

CVE-2025-21792 is a Linux kernel issue affecting AX25 binding via SO_BINDTODEVICE or ax25_bind, where refcount leaks occur in ax25_release due to improper refcount handling. The root cause is that when a device is bound to a socket, refcounts must already be incremented for the bound device, but ...

CVE-2025-21980

The CVE-2025-21980 entry concerns the Linux kernel GRED scheduler. It covers a potential NULL pointer dereference when kzalloc in gred_init returns NULL and the error path leads to gred_destroy, which calls gred_offload and may pass a NULL pointer to memset, potentially crashing the kernel. The i...

CVE-2025-22019

CVE-2025-22019 affects the Linux kernel component bcachefs. The issue in bch2_ioctl_subvolume_destroy and the inodes eviction path (bch2_evict_subvolume_inodes) was caused by incorrect dcache pruning and missing permissions checks. A fix was applied to address these, with potential impact to avai...

CVE-2025-22040

CVE-2025-22040 affects the Linux kernel ksmbd multichannel path. A race between session setup and ksmbd_sessions_deregister can free a session before its connection is added to the session’s channel list. The fix adds a reference-count check before freeing the session. Documented impact is high (...

CVE-2025-22102

CVE-2025-22102 affects the Linux kernel Bluetooth btnxpuart driver. The issue causes a kernel panic during FW release when WLAN/BT firmware downloads occur in parallel and the hardware delivers only one bootloader signature; the driver enters FW download mode but, after a 60-second timeout, a rel...

CVE-2025-22109

CVE-2025-22109 concerns the AX25 autobind feature in the Linux kernel. The linked debugging output shows memory leaks and refcount leaks in ax25_connect() and ax25_release() when autobind is used, caused by refcounts not being incremented as in ax25_bind()/ax25_setsockopt(SO_BINDTODEVICE). The fi...

CVE-2025-23129

CVE-2025-23129: In the Linux kernel, the ath11k PCI driver (ath11k_pci) could log a warning when error paths freed a shared IRQ without clearing the IRQ affinity hint. The root cause was setting the IRQ affinity hint after irq vector allocation in ath11k_pci_alloc_msi(), which caused free_irq in ...

CVE-2025-23134

CVE-2025-23134 affects the Linux kernel ALSA timer code. The vulnerability stems from taking mmap_lock while inside a mutex-wrapped copy_from/to_user() via the pattern guard(mutex)(&register_mutex). This can lead to deadlocks when copy_from/to_user() is invoked under the register_mutex, particula...

CVE-2025-37773

CVE-2025-37773 : In the Linux kernel, the virtiofs subsystem was updated to fix a NULL source-name in the filesystem context source name check. In fuzzing-like scenarios, the source name may be NULL, potentially triggering a kernel panic. The connected advisories confirm the issue and describe th...

CVE-2025-37831

Affected software: Linux kernel cpufreq subsystem on Apple SoCs. Issue: cpufreq_cpu_get_raw() may return NULL when the target CPU is not present in policy->cpus mask, and apple_soc_cpufreq_get_rate() does not check for this, leading to a NULL pointer dereference. Root cause: missing NULL check...

CVE-2025-37924

CVE-2025-37924 : Linux kernel ksmbd use-after-free in Kerberos authentication. A race could occur where a thread uses sess->user after it has been freed by ksmbd_free_user, prior to sess->user being set to NULL. The issue is fixed by setting sess->user = NULL to avoid dangling pointer. M...

CVE-2008-4307

CVE-2008-4307 is a Linux kernel local-denial-of-service issue caused by a race in do_setlk (fs/nfs/file.c) where improper handling of a race between fcntl and close in the EINTR path can crash the kernel and leave a stray FL_POSIX lock. Affected product: Linux kernel versions before 2.6.26. The v...

CVE-2009-1336

CVE-2009-1336 affects the Linux kernel (before 2.6.23) in the NFS client path. The issue is that a structure member that stores the maximum NFS filename length is not properly initialized, related to the encode_lookup function. This allows local users to trigger a denial of service (OOPS) by usin...

CVE-2009-3612

CVE-2009-3612 affects the Linux kernel’s net/sched/cls_api.c tcf_fill_node in the netlink subsystem. The issue is that a tcm__pad2 structure member is not initialized, potentially allowing local attackers to read sensitive kernel memory. Affected: kernel 2.6.x prior to 2.6.32-rc5 and 2.4.37.6 and...

CVE-2010-2492

CVE-2010-2492 affects the Linux kernel’s eCryptfs component: a buffer overflow in the ecryptfs_uid_hash macro (fs/ecryptfs/messaging.c) could allow local privilege escalation or a denial of service. The MiracleLinux AXSA advisory lists this CVE among kernel issues and specifies the flaw occurs in...

CVE-2013-2888

CVE-2013-2888 : The Linux kernel HID subsystem contains multiple array index errors in drivers/hid/hid-core.c that can be triggered by a crafted HID device providing an invalid Report ID. The vulnerability allows physically proximate attackers to execute arbitrary code or cause a denial of servic...

CVE-2014-1739

CVE-2014-1739 affects the Linux kernel before 3.14.6, where the function media_device_enum_entities in drivers/media/media-device.c fails to initialize a data structure. This leads to an information disclosure vulnerability: a local attacker with access to /dev/media0 can read kernel memory throu...

CVE-2014-5207

CVE-2014-5207 affects the Linux kernel up to version 3.16.1. The flaw occurs in fs/namespace.c where clearing MNT_NODEV, MNT_NOSUID, MNT_NOEXEC and changing MNT_ATIME_MASK during a remount of a bind mount is not properly restricted, allowing local users to gain privileges, interfere with backups/...

CVE-2015-4001

CVE-2015-4001 family affects the OZWPAN driver in the Linux kernel (drivers/staging/ozwpan/ozhcd.c and related ozusbsvc1.c parsing paths) up to kernel 4.0.5. Root cause is integer signedness and length-field handling flaws in the OZWPAN stack, enabling remote attackers to cause denial of service ...

CVE-2017-10662

The CVE-2017-10662 issue affects the Linux kernel’s F2FS implementation: the sanity_check_raw_super function in fs/f2fs/super.c fails to validate the segment count, enabling local privilege escalation. Concretely, affected versions are before 4.11.1. Several connected advisories (e.g., UTSA/Euler...

CVE-2017-13694

CVE-2017-13694 affects the Linux kernel up to 4.12.9. The acpi_ps_complete_final_op() function in drivers/acpi/acpica/psobject.c does not flush the node and node_ext caches, enabling a local attacker to trigger a kernel memory disclosure and bypass KASLR via a crafted ACPI table. The issue is mit...

CVE-2019-0145

CVE-2019-0145 : Buffer overflow in the i40e driver for Intel(R) Ethernet 700 Series Controllers, affecting versions before 7.0. An authenticated local user can potentially escalate privileges. The vulnerability arises in the i40e driver implementation and is documented in multiple advisories refe...

CVE-2021-47070

CVE-2021-47070 is described in the connected docs as a Linux kernel vulnerability in the uio_hv_generic driver where memory allocated by vmbus_alloc_ring() during probe is leaked in error handling paths. The fix adds a missing vmbus_free_ring() call, noting that the memory is already freed in the...

CVE-2021-47186

CVE-2021-47186 affects the Linux kernel TIPC subsystem: kmemdup can return NULL and is dereferenced in tipc_crypto_key_xmit if not checked. The provided docs confirm a NULL pointer dereference path and cite kernel commits improving null-checks as the fix. Impact is local with potential kernel den...

CVE-2021-47633

CVE-2021-47633 is described in connected documents as a Linux kernel flaw in the ath5k driver where, during EEPROM parsing (ath5k_eeprom_read_pcal_info_5111), an out-of-bounds write could occur when no curve is selected in a loop, allowing idx to reach AR5K_EEPROM_N_PD_CURVES and causing pd to be...

CVE-2022-3077

CVE-2022-3077 : A buffer overflow vulnerability in the Linux kernel Intel iSMT SMBus host controller driver, exposed via I2C_SMBUS (I2C_SMBUS_BLOCK_PROC_CALL) with malicious input. Local users can crash the system. Documents consistently reference this CVE in multiple advisories/plugins (e.g., Mi...

CVE-2022-3078

CVE-2022-3078 affects Linux kernels up to 5.16-rc6; it arises from a lack of a post-allocation check after vzalloc() and a missing free in drivers/media/test-drivers/vidtv/vidtv_s302m.c. This can enable memory mismanagement within the affected driver. A fix is available in kernel patch history (e...

CVE-2022-47938

Technical details are not publicly provided in the supplied documents. CVE-2022-47938 concerns ksmbd in the Linux kernel 5.15–5.19 before 5.19.2, with an out-of-bounds read during SMB2_TREE_CONNECT; monitor for updates.

CVE-2022-48796

CVE-2022-48796 relates to the Linux kernel iommu path where use-after-free can occur during device probe. The issue arises when freeing dev->iommu in dev_iommu_free while a deferred_probe_work_func accesses dev->iommu->fwspec in of_iommu_configure, leading to a KASAN use-after-free. The ...

CVE-2022-49015

The CVE-2022-49015 entry concerns a Linux kernel use-after-free in the net: hsr path. The issue arises when a socket buffer (skb) delivered to netif_rx() may be freed, and subsequent dereferencing of skb could trigger a UAF. Affects the Linux kernel’s hsr subsystem (net: hsr) and is tied to skb l...

CVE-2022-49350

CVE-2022-49350 affects the Linux kernel in the net/mdio area, where the symbol mdio_bus_init is annotated with init and exported. The combination of EXPORT_SYMBOL with init places code in .init.text, which may be freed after init and lead to a kernel panic if accessed by modules. The public advis...

CVE-2022-49557

CVE-2022-49557 relates to the Linux kernel, specifically the x86 fpu KVM path. The vulnerability arises when the guest FPU uABI size is set to the host default instead of the historical KVM uABI size, causing the kernel to configure the XSAVE header in a way that can lead to out-of-bounds writes ...

CVE-2022-49804

CVE-2022-49804 refers to a Linux kernel issue affecting s390 where making current_stack_pointer a global register variable exposed a gcc bug. The vulnerability is tied to stack pointer handling and can lead to stack corruption on affected builds. Public description notes that to mitigate, the min...

CVE-2022-49969

CVE-2022-49969 : In the Linux kernel, the drm/amd/display driver vulnerability “clear optc underflow before turn off odm clock” is fixed. After ODM clock off, the optc underflow bit could remain and clearing it before clock-off was ineffective. The fix adds a clear operation to reset this bit whe...

CVE-2022-50066

Summary: CVE-2022-50066 affects the Linux kernel’s net/atlantic driver (Aquantia) where the final iteration of a for loop can dereference an out-of-bounds aq_vec entry, causing a UBSAN array-index-out-of-bounds condition. The issue manifests as index 8 being out of range for aq_vec_s *[8] in aq_n...

CVE-2022-50100

CVE-2022-50100 affects the Linux kernel sched/core: Do not requeue a task on a CPU excluded from cpus_mask. The issue arises from a ttwu wakeup optimization that could queue a task on the wrong CPU, triggering an early-boot warning on large machines. The commit c6e7bd7afaeb implements a fix by en...

CVE-2023-0160

CVE-2023-0160 corresponds to a deadlock in the Linux kernel BPF subsystem that can be exploited locally to crash the system. Connected documents confirm the issue arises in the kernel’s eBPF/BPF path and affect Linux kernel versions including Astra Linux references to linux-5.10/5.15. The Amazon ...

CVE-2023-2019

CVE-2023-2019 : A flaw in the Linux kernel netdevsim device driver’s event scheduling due to improper management of a reference count. This can enable a local attacker to cause a denial-of-service on the system. The description and references in the connected docs point to a kernel-level issue; n...

CVE-2023-52618

CVE-2023-52618 affects the Linux kernel’s block/rnbd-srv path. The issue stems from copying dev_search_path and a second string into full_path, each sized PATH_MAX, which could truncate. The root cause was a potential truncation in snprintf(full_path, PATH_MAX, "%s/%s", dev_search_path, dev_name)...

CVE-2023-53126

The CVE-2023-53126 entry concerns the Linux kernel mpi3mr SCSI driver: a memory leak in sas_hba.phy within mpi3mr_remove() is fixed, specifically freeing mrioc->sas_hba.phy at .remove. The vulnerability affects the kernel's SCSI MPI3MR path and was addressed by the fix; no exploit details are ...

CVE-2024-26888

CVE-2024-26888 : Linux kernel vulnerability in Bluetooth msft path reported as fixed by a memory leak fix. The issue involved a leaking buffer allocated to send MSFT_OP_LE_MONITOR_ADVERTISEMENT. Public docs confirm the fix; CVSS indicates LOCAL attack vector with low to moderate impact (Base 5.5,...

CVE-2024-26917

CVE-2024-26917 affects the Linux kernel SCSI/FCoE path. The vulnerability stems from reverting a commit that changed spin lock usage for FCoE devices (from bh to irqsave), which caused interrupts to be lost for FCoE devices. The problem was introduced in the patch set around scsi: fcoe: Fix poten...

CVE-2024-35956

CVE-2024-35956 affects the Linux kernel's btrfs quota groups handling. During subvolume create/snapshot/delete, metadata reservations are made via btrfs_subvolume_reserve_metadata(). When quotas are enabled, a PREALLOC qgroup reservation is created and later converted to PERTRANS after the operat...

CVE-2024-37021

Technical details for CVE-2024-37021 are not publicly available in the provided connected documents. The initial description references fpga_manager owner/refcount changes in the Linux kernel, but no further technical specifics (affected products/versions/fixes) are given here. Monitor for updates.

CVE-2024-40909

CVE-2024-40909 is a Linux kernel vulnerability resolved in the bpf subsystem. After commit 1a80dbcb2dba, a race could cause a use-after-free when bpf_link is freed by link->ops->dealloc_deferred but the code still tests and uses link->ops->dealloc afterward. The fix ensures only one o...

CVE-2024-40990

The CVE-2024-40990 issue is a Linux kernel vulnerability in RDMA/mlx5 where the srq max_sge attribute, supplied by users, was inserted/used without proper bounds checks. The fix adds verification against the maximum allowed value before use, addressing potential overflow/abuse locally. Applicable...

CVE-2024-41034

CVE-2024-41034 — nilfs2 directory rename bug (Linux kernel) Affected component: nilfs2 in the Linux kernel. The issue occurs during a rename operation on a broken directory, where __block_write_begin_int() may fail due to an access beyond folio/page size when nilfs_dotdot() returns an invalid par...

CVE-2024-41050

CVE-2024-41050 (Linux kernel) affects the cachefiles subsystem, specifically the ondemand path handling of object reopening. The vulnerability arises from cyclic re-use of msg_id after a malicious reopen, which can cause a read request to remain unprocessed and lead to a hang. The root cause is r...

CVE-2024-42083

CVE-2024-42083 affects the Linux kernel, addressing a bug in ionic_run_xdp() where multi-buffer jumbo frames were not fully unmapped for XDP_TX/XDP_REDIRECT. SG pages could be reused, causing a kernel panic (general protection fault). A patch/fix was applied in the kernel (e.g., 6.10.x targets an...

CVE-2024-42313

CVE-2024-42313 affects the Linux kernel’s media: venus path, specifically a use-after-free in vdec_close() when the firmware queues a buffer-release work via HFI callbacks during decoding. The issue can occur if the decoder device is closed from userspace during normal decoding, potentially leadi...