CVE-2025-22025

CVE-2025-22025: In the Linux kernel NFS server (nfsd), if nfsd4_run_cb fails while queuing a dl_recall, the incremented dl_stid reference is not decremented, causing a potential dl_stid leak. The issue is addressed by checking the result of nfsd4_run_cb and, on failure, calling nfs4_put_stid to p...

CVE-2025-22026

CVE-2025-22026 (Linux kernel) affects nfsd in the kernel. The issue: nfsd_proc_stat_init() ignored the return value of svc_proc_register(), so if procfile creation fails the kernel may WARN later during removal. The fix updates nfsd_proc_stat_init() to return the same pointer type as svc_proc_reg...

CVE-2025-23134

CVE-2025-23134 affects the Linux kernel ALSA timer code. The vulnerability stems from taking mmap_lock while inside a mutex-wrapped copy_from/to_user() via the pattern guard(mutex)(&register_mutex). This can lead to deadlocks when copy_from/to_user() is invoked under the register_mutex, particula...

CVE-2025-23135

The CVE-2025-23135 issue is in the Linux kernel for RISC-V KVM teardown. The root cause is an ordering flaw during module removal: aia_exit is invoked before kvm_exit, which can leave IRQ state inconsistent (percpu IRQ 31 still enabled) and prevent the KVM module from re-insertion. The published ...

CVE-2025-37773

CVE-2025-37773 : In the Linux kernel, the virtiofs subsystem was updated to fix a NULL source-name in the filesystem context source name check. In fuzzing-like scenarios, the source name may be NULL, potentially triggering a kernel panic. The connected advisories confirm the issue and describe th...

CVE-2025-37886

CVE-2025-37886 : In the Linux kernel, the pds_core path updated to make the wait_context a full part of the q_info struct instead of a stack variable. The bug occurred when a slow development firmware caused an adminq request to time out, and after the wait loop, a completion context on the stack...

CVE-2025-38079

The CVE-2025-38079 entry concerns a vulnerability in the Linux kernel crypto/algif_hash: a double free in hash_accept when accept(2) is used on an algif_hash socket with MSG_MORE and crypto_ahash_import fails. This leads to a slab-use-after-free due to sk2 being freed in both hash_accept and af_a...

CVE-2008-5029

CVE-2008-5029 affects the Linux kernel 2.6.27.4, 2.6.26 and earlier via the __scm_destroy function in net/core/scm.c, which can cause indirect recursive calls when closing sockets after an SCM_RIGHTS message. This local DoS (panic) condition results from the kernel’s handling of UNIX domain socke...

CVE-2009-2695

CVE-2009-2695 affects the Linux kernel before 2.6.31-rc7, where mmap operations targeting page zero and other low memory addresses are not properly prevented. This enables local privilege escalation via NULL pointer dereference vulnerabilities, linked to (1) SELinux’s allow_unconfined_mmap_low se...

CVE-2010-4157

CVE-2010-4157 involves an integer overflow in the Linux kernel’s GDTH SCSI driver (gdth_ioctl_alloc/ioc_general) on 64-bit platforms. A 32/64-bit mismatch when handling a large argument in an ioctl can cause memory corruption, enabling a local user to trigger a denial of service (and potentially ...

CVE-2011-1171

CVE-2011-1171 affects the Linux kernel prior to 2.6.39, specifically the IPv4 netfilter ip_tables.c path. The issue is that string data in certain structure members may not end with the expected null terminator, enabling a local attacker with CAP_NET_ADMIN to craft a request and read the argument...

CVE-2011-2496

CVE-2011-2496 affects the Linux kernel prior to 2.6.39. An integer overflow in vma_to_resize (mm/mremap.c) lets local users trigger a BUG_ON and system crash via a crafted mremap call that expands a memory mapping. Mitigation: upgrade to kernel 2.6.39 or later where the issue is fixed. The connec...

CVE-2012-2121

CVE-2012-2121 affects the KVM component of the Linux kernel prior to 3.3.4. The vulnerability stems from improper management of the relationships between memory slots and the iommu, enabling guest OS users (with administrative access inside the guest) to trigger hotplug/hotunplug operations on de...

CVE-2013-2892

The CVE-2013-2892 issue affects the Linux kernel HID subsystem specifically the HID driver at drivers/hid/hid-pl.c. When CONFIG_HID_PANTHERLORD is enabled, a physically proximate crafted HID device can cause a heap-based out-of-bounds write, leading to a denial of service. The provided documents ...

CVE-2013-7281

CVE-2013-7281 affects the Linux kernel’s dgram_recvmsg in net/ieee802154/dgram.c and allows local users to leak kernel stack memory by updating a length value without initializing an associated data structure. The issue is fixed in kernel 3.12.4 (patch referenced in changelog), with exposure via ...

CVE-2014-8369

The CVE-2014-8369 flaw affects the Linux kernel and is caused by a miscalculation in kvm_iommu_map_pages (virt/kvm/iommu.c) when handling a mapping failure. The vulnerability exists in kernels up to 3.17.2 and arises from an incorrect fix for CVE-2014-3601. This allows guest OS users with privile...

CVE-2017-16650

CVE-2017-16650 affects the Linux kernel’s qmi_wwan_bind in drivers/net/usb/qmi_wwan.c (through kernel 4.13.11). A crafted USB device can be used by a local attacker to trigger a divide-by-zero, causing a denial of service (system crash) and potentially other impact. The vulnerability is locally e...

CVE-2017-17053

CVE-2017-17053 affects the Linux kernel, specifically the init_new_context code path in arch/x86/include/asm/mmu_context.h, for kernels built with CONFIG_MODIFY_LDT_SYSCALL=y. Before 4.12.10, errors from LDT table allocation when forking a new process are not handled correctly, enabling a local a...

CVE-2018-11508

CVE-2018-11508 affects the Linux kernel’s compat_get_timex implementation in kernel/compat.c, allowing a local attacker to disclose kernel memory via adjtimex, with affected versions up to but before 4.16.9. The issue’s public fixes are documented in ChangeLog-4.16.9 and Ubuntu security advisorie...

CVE-2022-48651

CVE-2022-48651 affects the Linux kernel ipvlan path. When an AF_PACKET socket uses PACKET_QDISC_BYPASS and the default xmit path is switched, skb->mac_header may remain at 65535, yielding slab-out-of-bounds in ipvlan_xmit_mode_l2. Root causes: packet_snd() only resets skb->mac_header for SO...

CVE-2022-48662

CVE-2022-48662 affects the Linux kernel i915 driver (i915_gem_context.link protection). The issue arises when removing a context from the gem.contexts list during context_close(), which can poison link.next while i915_perf holds a reference, leading to a general protection fault during i915_perf_...

CVE-2022-48938

CVE-2022-48938 affects the Linux kernel CDC-NCM path. The issue arises when a broken device provides an extreme offset (e.g., 0xFFF0) with a plausible fragment length, allowing an integer overflow in the existing sanity check. The description states that both offset and offset + len must be check...

CVE-2022-48951

The CVE-2022-48951 vulnerability is in the Linux kernel ASoC path: snd_soc_put_volsw_sx() does bounds checks only for the first channel, allowing potential out-of-bounds writes to the second channel in stereo controls. This is fixed upstream by adding proper checks (e.g., kernel commits cf611d......

CVE-2022-48953

CVE-2022-48953 — Linux kernel rtc-cmos init-order bug. The issue arises when rtc_handler() accesses driver data before cmos_do_probe() has completed, causing a NULL pointer dereference if the RTC fixed event fires at boot. The fix changes initialization order so that cmos_wake_setup() is called a...

CVE-2022-49015

The CVE-2022-49015 entry concerns a Linux kernel use-after-free in the net: hsr path. The issue arises when a socket buffer (skb) delivered to netif_rx() may be freed, and subsequent dereferencing of skb could trigger a UAF. Affects the Linux kernel’s hsr subsystem (net: hsr) and is tied to skb l...

CVE-2022-49238

CVE-2022-49238 concerns the Linux kernel ath11k driver for QCA6390/WCN6855. The issue arises when disconnecting from an AP: a commit sequence intended to fix a firmware crash ended up skipping all peer deletion, leaving peer->sta set and then used, causing a use-after-free. The log shows a use...

CVE-2022-49311

CVE-2022-49311 concerns a deadlock in the Linux kernel driver rtl8192bs (rtw_joinbss_event_prehandle) where a timer deletion under a spin_lock_bh caused a timer handler to wait on the same lock. The issue manifested as two threads blocking each other, risking an infinite hang. The documented fix ...

CVE-2022-49862

CVE-2022-49862 concerns the Linux kernel TIPC subsystem. The issue arises in tipc_nl_compat_name_table_dump_header where the msg->req TLV length is not properly validated, following a prior change intended to fix uninit-value behavior when TLV_GET_DATA_LEN() can be negative. This can lead to i...

CVE-2024-26917

CVE-2024-26917 affects the Linux kernel SCSI/FCoE path. The vulnerability stems from reverting a commit that changed spin lock usage for FCoE devices (from bh to irqsave), which caused interrupts to be lost for FCoE devices. The problem was introduced in the patch set around scsi: fcoe: Fix poten...

CVE-2024-35936

CVE-2024-35936. In the Linux kernel, the btrfs relocation code (btrfs_relocate_sys_chunks) contains an unhandled corruption case in its chunk-tree lookup loop. The issue arises from two theoretically impossible conditions: (1) an inexact search yields a key with offset -1 for a chunk-tree item, a...

CVE-2024-35956

CVE-2024-35956 affects the Linux kernel's btrfs quota groups handling. During subvolume create/snapshot/delete, metadata reservations are made via btrfs_subvolume_reserve_metadata(). When quotas are enabled, a PREALLOC qgroup reservation is created and later converted to PERTRANS after the operat...

CVE-2024-36021

CVE-2024-36021 affects the Linux kernel net driver for hns3, causing a kernel crash when a devlink reload occurs during PF initialization. The root cause is devlink reload accessing hardware resources before the hardware is initialized. A patch fixes this by taking devl_lock during initialization...

CVE-2024-36969

The CVE-2024-36969 issue affects the Linux kernel drm/amd/display component, specifically a division-by-zero in setup_dsc_config when slice_height is 0, which could crash the amdgpu driver and reboot the system. The patch introduces a guard to avoid dividing by zero (dc_dsc.c:1053; dc_dsc_compute...

CVE-2024-40980

CVE-2024-40980 concerns the Linux kernel: in drop_monitor, a spin_lock is used inside trace_drop_common() with preemption disabled, which can sleep in RT contexts. The vulnerability arises from acquiring a spin_lock while in a preempt-disabled/RT path, causing a potential sleeping-in-atomic conte...

CVE-2024-41050

CVE-2024-41050 (Linux kernel) affects the cachefiles subsystem, specifically the ondemand path handling of object reopening. The vulnerability arises from cyclic re-use of msg_id after a malicious reopen, which can cause a read request to remain unprocessed and lead to a hang. The root cause is r...

CVE-2024-41087

CVE-2024-41087 (Linux kernel) : The issue stems from the libata-core path “ata_host_alloc” where, on error, control may jump to err_out and call devres_release_group(), which triggers ata_host_release() and a subsequent kfree(host). If kfree(host) runs again in the normal path, a double free occu...

CVE-2024-42106

CVE-2024-42106 : In the Linux kernel, the inet_diag path for raw sockets could read an uninitialized pad field in inet_diag_req_v2 when converting inet_diag_req to v2, leading to uninitialized reads in raw_lookup(). The root cause is that inet_diag_get_exact_compat() and inet_diag_dump_compat() d...

CVE-2024-42295

CVE-2024-42295 — Linux kernel nilfs2 issue : Syzbot detected a buffer state inconsistency in nilfs_btnode_create_block that could occur when the argument block address is a virtual block number reallocated due to bitmap corruption. The patch changes nilfs_btnode_create_block() and its callers to ...

CVE-2024-42313

CVE-2024-42313 affects the Linux kernel’s media: venus path, specifically a use-after-free in vdec_close() when the firmware queues a buffer-release work via HFI callbacks during decoding. The issue can occur if the decoder device is closed from userspace during normal decoding, potentially leadi...

CVE-2024-43824

The CVE CVE-2024-43824 affects the Linux kernel PCI Express endpoint code (pci_epf_test). The vulnerability arises from use of cached epc_features in pci_epf_test_core_init() instead of querying via pci_epc_get_features(), removing a NULL check that was deemed redundant. The change relies on epc_...

CVE-2024-43841

CVE-2024-43841 affects the Linux kernel wifi/virt_wifi path. The vulnerability allowed a reported successful connection to be reported even when the SSID from user space differed from what virt_wifi advertised, because the SSID was not checked (only BSSID was validated). A fix was implemented in ...

CVE-2024-44963

CVE-2024-44963 — Linux kernel (btrfs): The issue occurs in btrfs_free_tree_block() when freeing a tree block and an error occurs creating a delayed reference. Instead of handling the error, a BUG_ON() could trigger, causing space leakage if memory allocation fails or other errors propagate via bt...

CVE-2024-45015

CVE-2024-45015 affects the Linux kernel component drm/msm/dpu. The vulnerability arises when crtc connectors_changed is set without a corresponding atomic_mode_set(), leading to an atomic_enable() followed by atomic_disable() without re-assigning the connector, causing NULL pointer dereference in...

CVE-2024-46717

CVE-2024-46717 relates to the Linux kernel mlx5e SHAMPO header handling. The bug caused SHAMPO header pages to be released more than once when a data page was used for a non-SHAMPO header, due to releasing a SHAMPO header page from header_index after a non-header data page was formed into a new s...

CVE-2024-46738

CVE-2024-46738 affects the Linux kernel VMCI subsystem. A use-after-free occurs in vmci_resource_remove() when removing a resource from vmci_resource_table if two resources share the same handle (same context and resource fields) but differ by type; the code previously could free the wrong object...

CVE-2024-46844

CVE-2024-46844: In the Linux kernel, the setup_one_line() path prints a pointer that could be uninitialized for *error_out, risking a NULL pointer dereference or incorrect prints. The fix initializes *error_out in all control paths, addressing the issue. The CVE is scored locally with high impact...

CVE-2024-46870

CVE-2024-46870 concerns the Linux kernel’s DRM/AMD display path, where a race condition can occur in DCN35 when DMCUB timeout is not appropriate. The provided description states that DMCUB can take longer to process commands, and the old ASIC policy could continue after a diagnostic error, riskin...

CVE-2024-47751

CVE-2024-47751 affects the Linux kernel PCI Kirin driver, where kirin_pcie_parse_port() could access beyond pcie->gpio_id_reset/MAX_PCI_SLOTS due to num_slots handling. The fix changes the condition to pcie->num_slots + 1 >= MAX_PCI_SLOTS and moves the increment of num_slots below the ch...

CVE-2024-49853

CVE-2024-49853 affects the Linux kernel firmware/arm_scmi path (OPTEE transport). The issue is a double-free in the OPTEE transport where channel descriptors can be freed twice when unloading the stack, due to channels being shared between protocols. This can lead to memory corruption or potentia...

CVE-2024-49865

CVE-2024-49865 affects the Linux kernel’s DRM XE VM code. The root cause is a use-after-free risk caused by the timing of allocating VM IDs with xa_alloc, which allowed an Evil user to guess the next VM id before vm destroy/ioctl completes, potentially exposing references to the same VM that is s...