CVE-2023-52567

CVE-2023-52567 : In the Linux kernel serial driver (8250_port), if a leaf driver uses IRQ polling (irq=0) and the IIR indicates an interrupt, the IRQ data can be NULL, potentially leading to a NULL pointer dereference. The published fix adds a check to ensure IRQ data is valid before wake-up hand...

CVE-2025-38429

The CVE-2025-38429 issue affects the Linux kernel’s bus: mhi: ep component, where the read pointer (rd_offset) in mhi_ep_ring_add_element is updated before the buffer is written. This race can allow the host to observe an updated read pointer prior to the buffer being fully written, risking acces...

CVE-2025-38471

CVE-2025-38471 concerns the Linux kernel TLS path. The TLS queue can operate on an old skb after aggressive net-next skb compaction, leading to a slab-use-after-free in tls_strp_check_rcv. The Astra Linux bulletin confirms the fix is to always refresh the queue when reading a socket, instead of r...

CVE-2025-39778

Technical details about CVE-2025-39778 (affected product, impact, and fix specifics) are not provided in the connected documents. Monitor for official disclosures and vendor advisories for updates and patch information.

CVE-2026-31414

CVE-2026-31414 (Linux kernel netfilter nf_conntrack_expect) The vulnerability arises from using nfct_help() without holding a reference to the master conntrack, leading to unsafe references when the helper is dumped via ctnetlink and /proc. The fix switches to using exp->master->helper in t...

CVE-2010-0727

CVE-2010-0727 affects the Linux kernel: the gfs2_lock (and on RHEL 5/6 gfs_lock) fails to properly remove POSIX locks on files that are setgid without group-execute permission. This allows a local attacker to trigger a denial of service or system crash by locking a file on a GFS or GFS2 filesyste...

CVE-2010-3849

CVE-2010-3849 affects the Linux kernel’s econet_sendmsg path (net/econet/af_econet.c) prior to 2.6.36.2, when an Econet address is configured. A local user can trigger a denial of service by issuing a sendmsg with a NULL remote address, causing a NULL pointer dereference and OOPS. The correspondi...

CVE-2010-4075

The CVE-2010-4075 entry affects the Linux kernel module code: uart_get_count (drivers/serial/serial_core.c) in versions prior to 2.6.37-rc1. The vulnerability arises from not properly initializing a certain structure member, enabling local users to read potentially sensitive information from kern...

CVE-2010-4163

The CVE-2010-4163 issue affects the Linux kernel, where blk_rq_map_user_iov in block/blk-map.c is vulnerable before version 2.6.36.2. A local attacker can trigger a denial of service (kernel panic) by submitting a zero-length I/O request via a device ioctl to a SCSI device. The description explic...

CVE-2011-2484

CVE-2011-2484 affects the Linux kernel, specifically code paths in kernel/taskstats.c. In kernels 2.6.39.1 and earlier, add_del_listener does not prevent multiple registrations of exit handlers, enabling a local attacker to cause denial of service through memory/CPU exhaustion and potentially byp...

CVE-2012-1090

CVE-2012-1090 affects the Linux kernel: the cifs_lookup function in fs/cifs/dir.c can trigger a local denial of service (OOPS) when a local user accesses a specially crafted file (e.g., a FIFO). The issue exists in kernel versions prior to 3.2.10. Exploitation requires local access. The documente...

CVE-2012-1601

CVE-2012-1601 concerns the KVM component of the Linux kernel. The vulnerability exists in the KVM implementation prior to version 3.3.6 and can be triggered by a host OS user making a KVM_CREATE_IRQCHIP ioctl after a virtual CPU already exists. The issue may lead to a NULL pointer dereference and...

CVE-2013-2889

CVE-2013-2889 affects the Linux kernel HID subsystem, specifically the HID driver file hid-zpff.c. When the CONFIG_HID_ZEROPLUS option is enabled, a crafted device can let physically proximate attackers cause a denial of service via a heap-based out-of-bounds write (heap corruption). The connecte...

CVE-2013-4162

CVE-2013-4162 : In the Linux kernel (IPv6 UDP implementation), the function udp_v6_push_pending_frames in net/ipv6/udp.c calls an incorrect function for pending data. This yields a local denial of service (BUG and system crash) when a crafted application uses UDP_CORK via setsockopt. Affected ver...

CVE-2013-6368

CVE-2013-6368 affects the KVM subsystem in the Linux kernel up to version 3.12.5, enabling local users to gain privileges or trigger a denial of service (system crash) via a VAPIC synchronization operation involving a page-end address. The connected advisories for MiracleLinux, Unity Linux, and E...

CVE-2015-6252

CVE-2015-6252 refers to a vulnerability in the Linux kernel where the vhost_dev_ioctl path in drivers/vhost/vhost.c allows local users to trigger a denial of service (memory consumption) by issuing a VHOST_SET_LOG_FD ioctl that can cause permanent file-descriptor allocation. The description speci...

CVE-2016-4557

CVE-2016-4557 affects the Linux kernel up to 4.5.4, where the replace_map_fd_with_map_ptr function in kernel/bpf/verifier.c mishandles an fd data structure, enabling local privilege escalation or a denial of service (use-after-free) via crafted BPF instructions referencing an incorrect file descr...

CVE-2017-15102

CVE-2017-15102 originates from the Linux kernel prior to 4.8.1, where the tower_probe function in drivers/usb/misc/legousbtower.c can be exploited locally by a near-physically proximate attacker via a crafted USB device. The issue is triggered by a write-what-where condition that arises after a r...

CVE-2017-17863

CVE-2017-17863 affects the Linux kernel 4.9.x up to 4.9.71, where the BPF verifier in kernel/bpf/verifier.c fails to check the relationship between pointer values and the BPF stack. This can allow local users to trigger a denial of service (integer overflow or invalid memory access) or potentiall...

CVE-2021-47576

CVE-2021-47576 concerns the Linux kernel SCSI subsystem, specifically the scsi_debug driver. The issue is a use-after-free (UAF) caused by insufficient validation of the block descriptor length in resp_mode_select(), leading to a KASAN crash (Read of size 1) in resp_mode_select() and related SCSI...

CVE-2022-48953

CVE-2022-48953 — Linux kernel rtc-cmos init-order bug. The issue arises when rtc_handler() accesses driver data before cmos_do_probe() has completed, causing a NULL pointer dereference if the RTC fixed event fires at boot. The fix changes initialization order so that cmos_wake_setup() is called a...

CVE-2022-49147

Technical details for CVE-2022-49147 are not publicly provided in the supplied documents; no affected products, impact, or remediation are specified here. Monitor for updates from connected sources.

CVE-2022-49557

CVE-2022-49557 affects the Linux kernel in x86/fpu/KVM. The root cause is KVM’s guest FPU uABI size being set to the host default instead of KVM’s historic size, causing out-of-bounds writes to the XSAVE header when saving FPU state for guests on hosts without XSAVE. This can lead to data corrupt...

CVE-2022-49890

CVE-2022-49890 covers a Linux kernel memleak in cap_inode_getsecurity() when using vfs_getxattr_alloc() to allocate tmpbuf. If tmpbuf allocation succeeds but handler->get() fails, memory leak could occur in the sequence (krealloc of xattr_value, then assignment back to *xattr_value). The mitig...

CVE-2022-49969

CVE-2022-49969 : In the Linux kernel, the drm/amd/display driver vulnerability “clear optc underflow before turn off odm clock” is fixed. After ODM clock off, the optc underflow bit could remain and clearing it before clock-off was ineffective. The fix adds a clear operation to reset this bit whe...

CVE-2023-3866

CVE-2023-3866 – ksmbd in the Linux kernel : The vulnerability arises from improper validation of the SMB session ID and tree ID in a compound request. If the first operation is an SMB2 ECHO, ksmbd may bypass session and tree validation, allowing work->sess and work->tcon to be NULL. A subse...

CVE-2023-4611

CVE-2023-4611 is a use-after-free in the Linux kernel memory subsystem (mm/mempolicy.c) caused by a race between mbind() and VMA-locked page fault. The vulnerability could allow a local attacker to crash the system or leak kernel information. Connected sources confirm the affected component and t...

CVE-2023-51782

The CVE-2023-51782 issue affects the Linux kernel (net/rose/af_rose.c) and is a use-after-free in rose_ioctl caused by a race in rose_accept. Affected versions are before 6.6.8. The vulnerability can lead to local privilege escalation or kernel crash. Mitigation: upgrade to Linux kernel 6.6.8 or ...

CVE-2023-52789

CVE-2023-52789 : In the Linux kernel, the vulnerability affects the tty/vcc path (vcc_probe). The root cause is failure to check the return value of kstrdup(), risking a NULL pointer dereference. The fix adds a check for kstrdup() and returns an error if it fails. This resolves the issue by preve...

CVE-2023-53079

The CVE-2023-53079 issue affects the Linux kernel mlx5 driver (net/mlx5) and related eswitch/vport flow-rule handling. Root cause: during EEH, vport MC/UC/multicast promiscuous rules aren’t deleted in teardown, and the firmware may reset these settings after EEH, causing the driver to attempt to ...

CVE-2023-53083

CVE-2023-53083 affects the Linux kernel NFSD splice path. If a splice read returns a partial page at end and the next splice completes it, the same page could be re-added, corrupting the reply by overwriting rq_respages/rq_next_page. The issue stems from nfsd_splice_actor previously handling cont...

CVE-2023-53102

Summary of CVE-2023-53102 (Linux kernel ice driver, AF_XDP/XSK): The issue arises in ice_qp_dis() when stopping a queue pair used by xsk pool attach/detach. TXQ interrupts were not reliably disabled before the hardware flush, allowing NAPI to run and freeing xdp_buff pointers prematurely, which c...

CVE-2023-53112

CVE-2023-53112 affects the Linux kernel DRM/I915 SSEU path. The root cause is an out-of-bounds access in intel_sseu_info_init/gen11_compute_sseu_info where gen11_sseu_info_init() could set 8 sub-slices while eu_mask->hsw is limited to 6, leading to index-out-of-bounds in a UBSAN report. The fi...

CVE-2023-53126

The CVE-2023-53126 entry concerns the Linux kernel mpi3mr SCSI driver: a memory leak in sas_hba.phy within mpi3mr_remove() is fixed, specifically freeing mrioc->sas_hba.phy at .remove. The vulnerability affects the kernel's SCSI MPI3MR path and was addressed by the fix; no exploit details are ...

CVE-2024-24860

CVE-2024-24860 : A race condition in the Linux kernel Bluetooth device driver, in the functions {min,max}_key_size_set(), can cause a NULL pointer dereference and potentially kernel panic or denial of service. Affected component: Linux kernel Bluetooth subsystem. Exploitation status and remediati...

CVE-2024-27412

Technical details about CVE-2024-27412 (affected product, root cause, impact, fix) are not provided in the connected documents; public details are limited to the CVE description in the initial document.

CVE-2024-35935

CVE-2024-35935 – Linux kernel (btrfs: send: handle path ref underflow in header iterate_inode_ref()) Connected documents confirm a concrete fix in the Linux kernel: when building a path buffer for iterate_inode_ref(), a BUG_ON-based path underflow handling was replaced with proper error handling ...

CVE-2024-36898

CVE-2024-36898 affects Linux kernel gpiolib: cdev. The issue is an uninitialised kfifo when software debounce is active and edge-detection is re-enabled, causing events to be written/read from an uninitialised queue. The published fix initializes the kfifo in the debounce-active path. Connected a...

CVE-2024-42083

CVE-2024-42083 concerns the Linux kernel driver for Pensando Ionic NICs. It describes a multi-buffer handling bug in ionic_run_xdp() where jumbo frames with SG pages are not properly unmapped or page pointers reset for XDP_TX/XDP_REDIRECT, risking reuse of SG pages and a kernel panic (general pro...

CVE-2024-42161

Technical details about CVE-2024-42161 are not publicly provided in the connected documents. The description mentions a Linux kernel BPF_CORE_READ_BITFIELD uninitialized value fix and a patch to initialize val, but there are no explicit affected products/versions or remediation steps beyond the p...

CVE-2024-42295

CVE-2024-42295 — Linux kernel nilfs2 issue : Syzbot detected a buffer state inconsistency in nilfs_btnode_create_block that could occur when the argument block address is a virtual block number reallocated due to bitmap corruption. The patch changes nilfs_btnode_create_block() and its callers to ...

CVE-2024-42313

CVE-2024-42313 affects the Linux kernel’s media: venus path, specifically a use-after-free in vdec_close() when the firmware queues a buffer-release work via HFI callbacks during decoding. The issue can occur if the decoder device is closed from userspace during normal decoding, potentially leadi...

CVE-2024-44959

CVE-2024-44959 targets the Linux kernel tracefs subsystem. The issue stems from a race condition in freeing inodes when structure layout randomization is enabled for 'struct inode', which risks overlapping RCU-used or one-time-initialized members (e.g., i_lru, i_sb_list) and can corrupt related l...

CVE-2024-44991

CVE-2024-44991 affects the Linux kernel TCP stack: concurrent calls to tcp_sk_exit_batch() can race with inet_twsk_purge() across dying netns, risking timewait sockets of the exiting netns. The root cause: after the net/core/net_namespace change (commit that batches inet_twsk_purge), tcp_twsk_pur...

CVE-2024-44996

The CVE-2024-44996 issue affects the Linux kernel vsock path when a vsock socket is added to a BPF sockmap. The bug arises when prot->recvmsg is replaced by vsock_bpf_recvmsg(), creating a recursive call chain: vsock_bpf_recvmsg() -> __vsock_recvmsg() -> vsock_connectible_recvmsg() ->...

CVE-2024-45028

Summary (CVE-2024-45028) : The vulnerability is in the Linux kernel code path mmc_test, where the allocation of test->highmem via alloc_pages() can lead to a NULL dereference when __free_pages(test->highmem) executes after allocation failure. The fix changes the dereference handling to avoi...

CVE-2024-46717

CVE-2024-46717 relates to the Linux kernel mlx5e SHAMPO header handling. The bug caused SHAMPO header pages to be released more than once when a data page was used for a non-SHAMPO header, due to releasing a SHAMPO header page from header_index after a non-header data page was formed into a new s...

CVE-2024-46739

The CVE-2024-46739 issue is in the Linux kernel (uio_hv_generic) and affects hv_uio_rescind for VM Bus channels. Root cause: the primary_channel pointer is NULL for primary channels and rescind callbacks are meant for primary channels only, leading to a NULL pointer dereference. The fix retrieves...

CVE-2024-46869

CVE-2024-46869 relates to the Linux kernel Bluetooth driver, specifically the btintel_pcie path. The issue was caused by not allocating memory for the driver-private data structure (struct btintel_data), leaving internal data storage unallocated. The connected Astra Linux security bulletin restat...

CVE-2024-46870

CVE-2024-46870 concerns the Linux kernel’s DRM/AMD display path, where a race condition can occur in DCN35 when DMCUB timeout is not appropriate. The provided description states that DMCUB can take longer to process commands, and the old ASIC policy could continue after a diagnostic error, riskin...