CVE-2022-49721

CVE-2022-49721 affects the Linux kernel (arm64) ftrace. The root cause is inconsistent handling of PLT entries when calling ftrace trampolines: ftrace_modify_call() can produce out-of-range branches, causing warnings and no code change, or replace the old branch with a BRK, risking a kernel panic...

CVE-2022-49862

CVE-2022-49862 concerns the Linux kernel TIPC subsystem. The issue arises in tipc_nl_compat_name_table_dump_header where the msg->req TLV length is not properly validated, following a prior change intended to fix uninit-value behavior when TLV_GET_DATA_LEN() can be negative. This can lead to i...

CVE-2022-49890

CVE-2022-49890 covers a Linux kernel memleak in cap_inode_getsecurity() when using vfs_getxattr_alloc() to allocate tmpbuf. If tmpbuf allocation succeeds but handler->get() fails, memory leak could occur in the sequence (krealloc of xattr_value, then assignment back to *xattr_value). The mitig...

CVE-2022-50073

CVE-2022-50073 affects the Linux kernel TAP path. Root cause: in dev_parse_header_protocol the code dereferences skb->dev which can be NULL when the tap driver calls virtio_net_hdr_to_skb, causing a NULL pointer dereference. The issue is triggered in tap_get_user/tap_sendmsg paths and can cras...

CVE-2023-3865

CVE-2023-3865 affects the ksmbd component of the Linux kernel (smb2_write). Root cause: ksmbd_smb2_check_message does not validate hdr->NextCommand; if NextCommand > Offset+Length of smb2 write, an oversized length allows an out-of-bounds read in smb2_write. Implication: out-of-bounds read ...

CVE-2023-52569

CVE-2023-52569 affects the Linux kernel's btrfs code path. The patch removes a BUG() on failure to insert a delayed dir index item and adds proper error handling, but it does not fix the underlying issue of using the same index number for different items, per the provided documentation. No exploi...

CVE-2023-52640

CVE-2023-52640 (Linux kernel ntfs3): The issue is a local, out-of-bounds in ntfs_listxattr where the length of the name must not exceed the allocated EA space. Affected code path is in the ntfs3 filesystem. The connected Astra Linux advisory confirms the same vulnerability and indicates a resolve...

CVE-2023-53017

The CVE-2023-53017 entry concerns a memory leak in the Linux kernel Bluetooth stack (hci_sync path). Root cause: in hci_update_adv_data(), if hci_cmd_sync_queue() fails, the allocated inst_ptr was not freed. Mitigation: switch to using ERR_PTR/PTR_ERR to pass the instance to the callback, so no a...

CVE-2023-53083

CVE-2023-53083 affects the Linux kernel NFSD splice path. If a splice read returns a partial page at end and the next splice completes it, the same page could be re-added, corrupting the reply by overwriting rq_respages/rq_next_page. The issue stems from nfsd_splice_actor previously handling cont...

CVE-2024-26702

CVE-2024-26702 : In the Linux kernel, the iio: magnetometer RM3100 driver added a boundary check for the value read from RM3100_REG_TMRC to prevent an out-of-bounds access that could crash rm3100_common_probe. The crash was caused by out-of-bounds access of the rm3100_samp_rates array due to hard...

CVE-2024-26742

The CVE-2024-26742 issue lies in the Linux kernel’s scsi: smartpqi driver, where enablement of the default PCI_IRQ_AFFINITY flag caused incorrect registration with the block layer (blk_mq_pci_map_queues was used instead of blk_mq_map_queues). This could produce a stack trace and potentially undef...

CVE-2024-37021

Technical details for CVE-2024-37021 are not publicly available in the provided connected documents. The initial description references fpga_manager owner/refcount changes in the Linux kernel, but no further technical specifics (affected products/versions/fixes) are given here. Monitor for updates.

CVE-2024-39468

CVE-2024-39468 : Linux kernel SMB/CIFS client deadlock in smb2_find_smb_tcon() fixed by unlocking cifs_tcp_ses_lock before calling cifs_put_smb_ses(). Affected component is the SMB client in the kernel; deadlock could occur locally via SMB2 TCON handling. Public references point to kernel.org sta...

CVE-2024-40915

The CVE-2024-40915 issue affects the Linux kernel on riscv, where __kernel_map_pages() (a debugging page-table helper) used __set_memory() to flip the valid bit of page-table entries. __set_memory() takes init_mm’s semaphore and can sleep, but __kernel_map_pages() may be called in atomic context,...

CVE-2024-40976

CVE-2024-40976 — Linux kernel (drm/lima) Affected: drm/lima in the Linux kernel. Description details a race in which a rendering job may trigger the drm sched timeout handler and still complete before the hard reset, risking a refcount imbalance on lima_pm_idle and producing stack traces. Root ca...

CVE-2024-41046

CVE-2024-41046 affects the Linux kernel net: ethernet: lantiq_etop driver. The issue is a double-free in detach caused by never incrementing the currently released descriptor, leading to releasing the same skb multiple times. A patch addressing this is published in stable kernels (as cited by the...

CVE-2024-42083

CVE-2024-42083 concerns the Linux kernel driver for Pensando Ionic NICs. It describes a multi-buffer handling bug in ionic_run_xdp() where jumbo frames with SG pages are not properly unmapped or page pointers reset for XDP_TX/XDP_REDIRECT, risking reuse of SG pages and a kernel panic (general pro...

CVE-2024-42313

CVE-2024-42313 affects the Linux kernel’s media: venus path, specifically a use-after-free in vdec_close() when the firmware queues a buffer-release work via HFI callbacks during decoding. The issue can occur if the decoder device is closed from userspace during normal decoding, potentially leadi...

CVE-2024-44959

CVE-2024-44959 targets the Linux kernel tracefs subsystem. The issue stems from a race condition in freeing inodes when structure layout randomization is enabled for 'struct inode', which risks overlapping RCU-used or one-time-initialized members (e.g., i_lru, i_sb_list) and can corrupt related l...

CVE-2024-46870

CVE-2024-46870 concerns the Linux kernel’s DRM/AMD display path, where a race condition can occur in DCN35 when DMCUB timeout is not appropriate. The provided description states that DMCUB can take longer to process commands, and the old ASIC policy could continue after a diagnostic error, riskin...

CVE-2024-47732

CVE-2024-47732 is a Linux kernel crypto issue reported as a potential use-after-free in iaa compression mode handling. The OSV entry notes that free_device_compression_mode(iaa_device, device_mode) frees device_mode and then passes it to iaa_compression_modes[i]->free(), which could cause use-...

CVE-2024-47734

CVE-2024-47734: In the Linux kernel, the bonding subsystem fixed unnecessary warnings/logs from bond_xdp_get_xmit_slave(). The patch removes a WARN_ON_ONCE() and adds rate limiting to netdev_err() to reduce log noise when XDP is used on bonded interfaces (e.g., with bond1 xdpdrv and bond0/slave v...

CVE-2024-47751

CVE-2024-47751 affects the Linux kernel PCI Kirin driver, where kirin_pcie_parse_port() could access beyond pcie->gpio_id_reset/MAX_PCI_SLOTS due to num_slots handling. The fix changes the condition to pcie->num_slots + 1 >= MAX_PCI_SLOTS and moves the increment of num_slots below the ch...

CVE-2024-49853

CVE-2024-49853 affects the Linux kernel firmware/arm_scmi path (OPTEE transport). The issue is a double-free in the OPTEE transport where channel descriptors can be freed twice when unloading the stack, due to channels being shared between protocols. This can lead to memory corruption or potentia...

CVE-2024-49857

CVE-2024-49857 affects the Linux kernel WiFi stack (iwlwifi, mvm) where the cipher pointer is dereferenced without being initialized, causing a NULL pointer dereference. The vulnerability is fixed by setting the cipher parameter before dereferencing, thereby preventing the crash/possible impact d...

CVE-2024-50020

CVE-2024-50020 (Linux kernel) affects the ice driver’s refcount handling in ice_sriov_set_msix_vec_count(). The issue: vf pointer reference counts were leaked if ice_get_vf_by_id() succeeds but ice_get_vf_vsi() fails, or if vf->first_vector_idx

CVE-2024-50111

CVE-2024-50111 affects LoongArch Linux kernel where unaligned access can trigger in irq-enabled context; do_ale() may call get_user(), causing sleep and BUG: sleeping function called from invalid context. The fix described in the unpatched Nessus entry is to enable IRQ handling for unaligned acce...

CVE-2024-50243

CVE-2024-50243 affects the Linux kernel ntfs3 path; the issue is a general protection fault in run_is_mapped_full leading to a local denial of service. The fix (and related NTFS attribute handling fix) was committed in the kernel; affected advisories reference kernel 6.1.x updates. Remediation is...

CVE-2024-54458

The CVE-2024-54458 issue is in the Linux kernel, involving the SCSI/ufs subsystem (bsg path). The root cause is not fully described beyond the fix: after removing the bsg_queue, it should be set to NULL to avoid potential use-after-free (UAF). The advisory states this vulnerability has been resol...

CVE-2024-56540

In CVE-2024-56540, the Linux kernel ivpu IPC path (drivers/accel/ivpu/ivpu_ipc.c) was refactored: ipc send/receive functions were adjusted to avoid triggering a recovery during probe/resume. ivpu_send_receive_internal() is now used by D0i3 entry, DCT init, and HW init, with updated functions retu...

CVE-2024-56771

CVE-2024-56771 concerns the Linux kernel mtd/spinand/winbond NAND ECC handling. Four WINBOND 3D NAND chips (W25N512GW, W25N01GW, W25N01JW, W25N02JW) rely on a single-bit ECC engine on-die. The issue arises because querying per-chunk bitflips via ->get_status() is unnecessary and unsupported fo...

CVE-2024-58061

CVE-2024-58061 affects the Linux kernel wifi/mac80211 component. The issue arises when trying to deactivate all links via a debugfs write, where an internal WARN_ON is triggered and should have prevented deactivation; the patch fixes this to prohibit deactivating all links. This vulnerability is ...

CVE-2025-21634

CVE-2025-21634 concerns the Linux kernel cpuset/cgroup path where kernfs active protection can be broken during concurrent cpuset writes, triggering a warning and potential deadlock risk. The root cause involved a sequence of hotplug-related changes that async/sync cpuset processing and previousl...

CVE-2025-21723

Summary (CVE-2025-21723) In the Linux kernel, mpi3mr/scsi code was fixed to prevent a crash when BSG setup fails. If bsg_setup_queue() fails, bsg_queue may be non-NULL, causing mpi3mr_bsg_exit() to skip bsg_remove_queue() and trigger a NULL pointer dereference (kernel crash) as shown in the entry...

CVE-2025-21743

CVE-2025-21743 affects the Linux kernel’s usbnet/ipheth handling. The vulnerability stems from an overflow in the DPE length check when wDatagramIndex + wDatagramLength could exceed U16_MAX, allowing an OoB read. The fix moves the wDatagramIndex term across the inequality, preserving the existing...

CVE-2025-21884

CVE-2025-21884 concerns the Linux kernel topic “net: better track kernel sockets lifetime.” The description in Astra Linux and related Nessus references show the issue arises because kernel sockets freed during pernet_operations->exit() can be delayed by remaining tx packets in qdisc/device qu...

CVE-2025-21960

CVE-2025-21960 is addressed in the TencentOS Server 4 kernel advisory (TSSA-2025:0348). The issue is in nbd reconnect handling after disconnect, potentially enabling a use-after-free via recv_work when nbd_config is freed. The advisory states the root cause: in nbd_genl_disconnect(), NBD_RT_BOUND...

CVE-2025-22026

CVE-2025-22026 (Linux kernel) affects nfsd in the kernel. The issue: nfsd_proc_stat_init() ignored the return value of svc_proc_register(), so if procfile creation fails the kernel may WARN later during removal. The fix updates nfsd_proc_stat_init() to return the same pointer type as svc_proc_reg...

CVE-2025-22085

CVE-2025-22085 affects the Linux kernel RDMA/core. The description documents a use-after-free (slab) in the netlink/name rename path, caused by a use-after-free in nla_put during device-name rename handling. The issue manifests as a slab-use-after-free Read in nla_put, traced through netlink/nlde...

CVE-2025-22107

CVE-2025-22107 - Linux kernel (net: dsa: sja1105) Root cause: in sja1105_table_delete_entry, deleting the last element in the table incorrectly calls memmove over an out-of-bounds element, and the number of elements moved should be size - i - 1. This leads to touching an out-of-bounds memory loca...

CVE-2025-23140

CVE-2025-23140 affects the Linux kernel PCI Endpoint Test driver. The issue arose when devm_request_irq() failed in pci_endpoint_test_request_irq(): some IRQs were not released, leaving /proc/irq entries and triggering a WARN in fs/proc/generic.c (remove_proc_entry). The root cause is that pci_en...

CVE-2025-23149

CVE-2025-23149 refers to a Linux kernel vulnerability in TPM handling. The issue is triggered when TPM_CHIP_FLAG_SUSPENDED is checked after tpm_find_get_ops(), which can spuriously invoke tpm_chip_start() while the TPM chip is suspended. The provided logs show a sequence leading to a potential tr...

CVE-2025-37886

CVE-2025-37886 : In the Linux kernel, the pds_core path updated to make the wait_context a full part of the q_info struct instead of a stack variable. The bug occurred when a slow development firmware caused an adminq request to time out, and after the wait loop, a completion context on the stack...

CVE-2025-37892

In CVE-2025-37892, the Linux kernel mtd/inftlcore had a missing error check for inftl_read_oob() in INFTL_findwriteunit(); the return value must be validated, with reference logic located in INFTL_deleteblock() to set the status to SECTOR_IGNORE and break the loop when inftl_read_oob() fails. Con...

CVE-2025-37968

CVE-2025-37968 (Linux kernel) affects the iio: light: opt3001 driver. The issue is a deadlock in a threaded IRQ path caused by reading the same flag twice (once for mutex_lock, once for mutex_unlock). The fix standardizes the flag handling by reading it into a local variable and reusing that valu...

CVE-2003-0127

CVE-2003-0127 affects the Linux kernel 2.2.x before 2.2.25 and 2.4.x before 2.4.21. A local attacker can gain root privileges by using ptrace to attach to a child process spawned by the kernel. The description explicitly states the root cause is the kernel module loader’s handling of ptrace with ...

CVE-2008-1669

Summary: CVE-2008-1669 affects the Linux kernel and arises from inadequate protection for fcntl in 2.6.x kernels prior to 2.6.25.2. The issue enables local users to (1) execute code in parallel and (2) trigger a race that can give re-ordered access to the descriptor table. Evidence in connected a...

CVE-2010-0727

CVE-2010-0727 affects the Linux kernel: the gfs2_lock (and on RHEL 5/6 gfs_lock) fails to properly remove POSIX locks on files that are setgid without group-execute permission. This allows a local attacker to trigger a denial of service or system crash by locking a file on a GFS or GFS2 filesyste...

CVE-2010-2524

CVE-2010-2524 affects the Linux kernel CIFS DNS upcall: when CONFIG_CIFS_DFS_UPCALL is enabled, DNS resolution relies on a user keyring via the dns_resolver upcall in the cifs.upcall userspace helper. This allows local privileged or nearby users to spoof DNS query results and mount arbitrary CIFS...

CVE-2010-3078

The CVE-2010-3078 issue affects the Linux kernel (xfs_ioc_fsgetxattr) where a structure member is not initialized, enabling local attackers to read potentially sensitive data from kernel stack memory via an ioctl. This vulnerability is documented in MiracleLinux AXSA-2010-500:18 and is fixed in 2...