CVE-2024-40990

The CVE-2024-40990 issue is a Linux kernel vulnerability in RDMA/mlx5 where the srq max_sge attribute, supplied by users, was inserted/used without proper bounds checks. The fix adds verification against the maximum allowed value before use, addressing potential overflow/abuse locally. Applicable...

CVE-2024-41034

CVE-2024-41034 — nilfs2 directory rename bug (Linux kernel) Affected component: nilfs2 in the Linux kernel. The issue occurs during a rename operation on a broken directory, where __block_write_begin_int() may fail due to an access beyond folio/page size when nilfs_dotdot() returns an invalid par...

CVE-2024-41050

CVE-2024-41050 (Linux kernel) affects the cachefiles subsystem, specifically the ondemand path handling of object reopening. The vulnerability arises from cyclic re-use of msg_id after a malicious reopen, which can cause a read request to remain unprocessed and lead to a hang. The root cause is r...

CVE-2024-42083

CVE-2024-42083 affects the Linux kernel, addressing a bug in ionic_run_xdp() where multi-buffer jumbo frames were not fully unmapped for XDP_TX/XDP_REDIRECT. SG pages could be reused, causing a kernel panic (general protection fault). A patch/fix was applied in the kernel (e.g., 6.10.x targets an...

CVE-2024-42313

CVE-2024-42313 affects the Linux kernel’s media: venus path, specifically a use-after-free in vdec_close() when the firmware queues a buffer-release work via HFI callbacks during decoding. The issue can occur if the decoder device is closed from userspace during normal decoding, potentially leadi...

CVE-2024-42320

CVE-2024-42320 affects the Linux kernel’s s390/dasd subsystem. The root cause is a missing validation of the result from dasd_add_busid() when an allocation fails, which could yield a NULL pointer dereference in dasd_copy_pair_store() . The fix adds a check using IS_ERR() and propagates the error...

CVE-2024-43883

CVE-2024-43883 is a Linux kernel issue in the usb vhci-hcd driver. The bug allowed stale references to be carried due to dropping existing references before new ones are gained, potentially enabling use-after references. The description and linked advisories show the root cause as racing/dropping...

CVE-2024-43894

CVE-2024-43894 — kernel DRM NULL-deref fix : In the Linux kernel drm/client path, the function drm_client_modeset_probe can dereference a NULL after drm_mode_duplicate() fails because the returned pointer is assigned directly to modeset->mode. The patch adds a safety check to avoid NULL pointe...

CVE-2024-44963

CVE-2024-44963 — Linux kernel (btrfs): The issue occurs in btrfs_free_tree_block() when freeing a tree block and an error occurs creating a delayed reference. Instead of handling the error, a BUG_ON() could trigger, causing space leakage if memory allocation fails or other errors propagate via bt...

CVE-2024-47750

CVE-2024-47750: In the Linux kernel, RDMA/hns on HIP08 had a Use-After-Free of rsv_qp because rsv_qp was freed before ib_unregister_device() was called. The documented fix moves the release of rsv_qp to after ib_unregister_device(). Affected component: RDMA/hns in HIP08; impact is Use-After-Free,...

CVE-2024-47751

CVE-2024-47751 affects the Linux kernel PCI Kirin driver, where kirin_pcie_parse_port() could access beyond pcie->gpio_id_reset/MAX_PCI_SLOTS due to num_slots handling. The fix changes the condition to pcie->num_slots + 1 >= MAX_PCI_SLOTS and moves the increment of num_slots below the ch...

CVE-2024-50020

CVE-2024-50020 (Linux kernel) affects the ice driver’s refcount handling in ice_sriov_set_msix_vec_count(). The issue: vf pointer reference counts were leaked if ice_get_vf_by_id() succeeds but ice_get_vf_vsi() fails, or if vf->first_vector_idx

CVE-2024-50276

CVE-2024-50276 affects the Linux kernel net driver for vertexcom mse102x. The issue was a potential double-free of TX skb: the TX skb scope is broader than mse102x_tx_frame_spi(), so if the TX skb needs expansion, the code must free the temporary skb, not the original TX skb. Failing to do so cou...

CVE-2024-53154

Technical details for CVE-2024-53154 are not provided in the connected documents. The initial description mentions a NULL check added in applnco_probe for clk-apple-nco in the Linux kernel.

CVE-2024-53167

CVE-2024-53167 (Linux kernel) relates to an unregister path in NFS/pNFS block layout where unmounting a pNFS SCSI layout-enabled NFS could dereference a NULL block_device if no device could be attached to pnfs_block_dev. The root cause is a premature dereference during unregistration after the nf...

CVE-2024-53200

Technical details about CVE-2024-53200 are not publicly provided in the supplied documents. Monitor vendor advisories for updates, affected products, impact, and fixes.

CVE-2024-53228

Technical details about CVE-2024-53228 are not publicly provided in the supplied documents; only a high-level summary of the fix (riscv kvm out-of-bounds check) is present. Monitor for updates.

CVE-2024-56684

CVE-2024-56684: In the Linux kernel, mailbox: mtk-cmdq had a wrong sizeof usage in cmdq_get_clocks() where a data pointer was passed to devm_kcalloc(); the allocation should be sizeof(struct clk_bulk_data). The patch fixes the allocation size, addressing a potential memory/overflow issue when con...

CVE-2024-56702

The CVE-2024-56702 issue is a Linux kernel fix for BPF raw tracepoints. It explains that raw_tp arguments were previously treated as non-NULL, risking NULL dereferences when NULL values occur. The fix marks raw_tp arguments as PTR_MAYBE_NULL and adjusts dereferences, arithmetic, and allowed passe...

CVE-2024-58070

Technical details for CVE-2024-58070 are not present in the provided connected documents. The initial description mentions the fix in PREEMPT_RT for bpf_local_storage, but no concrete product/version/root-cause/exploit details are supplied. Monitor for updates.

CVE-2024-58080

CVE-2024-58080 is a Linux kernel issue in the QCOM clock framework (dispcc-sm6350). The root cause is a missing parent_map for clk_rcg2 when it has a parent, which can lead to a NULL pointer dereference during clk_set_rate. The provided description shows a call trace and explains that the fix add...

CVE-2024-58096

The CVE-2024-58096 entry concerns the Linux kernel wifi/ath11k monitoring path. The vulnerability arises when srng data is accessed via ath11k_hal_srng_* without acquiring srng->lock in monitor mode, potentially triggering warnings (RIP: ath11k_hal_srng_dst_peek) during (full) monitor operatio...

CVE-2025-21707

CVE-2025-21707 affects the Linux kernel MPTCP implementation. The issue stems from how MPTCP maintains received suboption status as a bitmask and per-suboption info. Zeroing the status bitmask on parse isn’t sufficient; some per-suboption bitfields aren’t cleared/initialized for certain parsed su...

CVE-2025-21725

CVE-2025-21725 Affects the Linux kernel SMB/CIFS client. The issue occurs when NETWORK_INTERFACE_INFO::LinkSpeed is not set, which can trigger an oops/divide error in cifs_debug_data_proc_show. The patch fixes this by initializing cifs_server_iface::speed to a sane default of 1 Gbps when the link...

CVE-2025-21732

CVE-2025-21732 pertains to the Linux kernel RDMA mlx5 path. It describes a race in the ODP MR handling where, during __mlx5_ib_dereg_mr(), a concurrent mlx5_ib_invalidate_range() can invalidate a freed lkey, triggering a CQE error and potentially placing the UMR QP in an error state. The disclose...

CVE-2025-21828

CVE-2025-21828 affects the Linux kernel wireless stack (wifi: mac80211). When a station (STA) is pre-moved to AUTHORIZED (e.g., in IBSS) and insertion fails, the STA can be freed without the driver knowing about it; an attempted flush of an untracked STA may crash. The description notes the root ...

CVE-2025-22015

Technical details for CVE-2025-22015 are not publicly available in the provided documents. Monitor for updates from vendors and security advisories.

CVE-2025-22069

The CVE-2025-22069 entry concerns a Linux kernel riscv fgraph issue where stack layout for ftrace_return_to_handler argument did not match __arch_ftrace_regs, causing a Bad frame pointer warning. Affected component: riscv ftrace path in kernel/trace/fgraph.c; root cause: mismatch between the cons...

CVE-2025-23133

The CVE-2025-23133 issue is in Linux kernel ath11k: when a new channel list is received, it updates cfg80211 and queues reg_work, but may immediately execute reg_update_chan_list() before cfg80211 finishes handling the list, causing a potential slab-out-of-bounds write (KASAN) in ath11k_reg_updat...

CVE-2025-23135

The CVE-2025-23135 issue is in the Linux kernel for RISC-V KVM teardown. The root cause is an ordering flaw during module removal: aia_exit is invoked before kvm_exit, which can leave IRQ state inconsistent (percpu IRQ 31 still enabled) and prevent the KVM module from re-insertion. The published ...

CVE-2025-37892

In CVE-2025-37892, the Linux kernel mtd/inftlcore had a missing error check for inftl_read_oob() in INFTL_findwriteunit(); the return value must be validated, with reference logic located in INFTL_deleteblock() to set the status to SECTOR_IGNORE and break the loop when inftl_read_oob() fails. Con...

CVE-2025-37921

The CVE-2025-37921 entry covers a Linux kernel VXLAN vnifilter issue where deleting a VNI could remove the default FDB entry without holding the hash lock. Root cause: unlocked deletion of the default FDB entry when a VNI is removed from a VXLAN device in vnifilter mode. Impact: described warning...

CVE-2025-37999

The CVE-2025-37999 issue affects the Linux kernel's EROFS fileio path. When bio_add_folio() fails, erofs_fileio_scan_folio() submits a new I/O request and retries with an empty bio, but erofs_onlinefolio_split() had already run, incrementing folio->private. The retry then calls erofs_onlinefol...

CVE-2007-6206

CVE-2007-6206 affects the Linux kernel (2.4.x and 2.6.x up to 2.6.24-rc3). The issue lies in the do_coredump function in fs/exec.c, where the core dump file’s UID is not changed if a core dump already exists in the same location when a root-owned process dumps a core. This behavior could allow a ...

CVE-2008-1669

Summary: CVE-2008-1669 affects the Linux kernel and arises from inadequate protection for fcntl in 2.6.x kernels prior to 2.6.25.2. The issue enables local users to (1) execute code in parallel and (2) trigger a race that can give re-ordered access to the descriptor table. Evidence in connected a...

CVE-2010-3310

CVE-2010-3310 refers to multiple signedness errors in net/rose/af_rose.c of the Linux kernel, fixed before 2.6.36-rc5-next-20100923. The vulnerability allows local users to induce a denial of service (heap memory corruption) or possibly cause other unspecified impacts through a rose_getname call ...

CVE-2010-4242

CVE-2010-4242 affects the Linux kernel 2.6.36 (and possibly other versions). The vulnerability is in the HCI UART driver, specifically the hci_uart_tty_open function in drivers/bluetooth/hci_ldisc.c, which does not verify if the tty has a write operation. This can allow a local user to cause a de...

CVE-2011-1082

CVE-2011-1082 affects the Linux kernel prior to 2.6.38. The flaw is in fs/eventpoll.c where epoll file descriptors may be placed inside other epoll data structures without proper validation of closed loops or deep chains. This can let a local user cause a denial of service (deadlock or stack memo...

CVE-2011-2213

The CVE-2011-2213 issue concerns the Linux kernel vulnerability in inet_diag_bc_audit (net/ipv4/inet_diag.c) present before 2.6.39.3. Affected component audits INET_DIAG bytecode and, when processing crafted INET_DIAG_REQ_BYTECODE messages (e.g., an INET_DIAG_BC_JMP with a zero yes value), allows...

CVE-2012-2313

The CVE-2012-2313 issue affects the Linux kernel up to version 3.3.7, where rio_ioctl in drivers/net/ethernet/dlink/dl2k.c does not restrict access to the SIOCSMIIREG ioctl. This allows local attackers to write data to an Ethernet adapter via an ioctl call. The vulnerability is rooted in insuffic...

CVE-2012-2373

CVE-2012-2373 affects the Linux kernel before 3.4.5 on x86 with Physical Address Extension (PAE) enabled. It arises from improper use of the Page Middle Directory (PMD), enabling a race condition that local users can trigger to cause a denial of service (panic) via a crafted application. The conn...

CVE-2012-3375

CVE-2012-3375—Linux kernel epoll_ctl DoS Affected: Linux kernel before 3.2.24 (fs/eventpoll.c).Cause: EPOLL_CTL_ADD mishandles ELOOP errors, due to an incorrect fix for CVE-2011-1083.Impact: Local users can trigger a denial of service via a crafted application that creates circular epoll dependen...

CVE-2013-0231

CVE-2013-0231 is discussed in connected advisories as affecting the Xen PCI backend: the pciback_enable_msi function in drivers/xen/pciback/conf_space_capability_msi.c on Linux kernels 2.6.18 and 3.8 allows guest OS users with PCI device access to trigger a denial of service by generating a large...

CVE-2013-2232

CVE-2013-2232 affects the Linux kernel prior to 3.10. The vulnerable code is the ip6_sk_dst_check function in net/ipv6/ip6_output.c; it lets a local user cause a denial-of-service (system crash) by using an AF_INET6 socket to connect to an IPv4 interface. A remedy is the upstream patch applied in...

CVE-2013-2234

CVE-2013-2234: In the Linux kernel (net/key/af_key.c), the functions key_notify_sa_flush and key_notify_policy_flush do not initialize certain structure members in versions before 3.10, allowing local users to read sensitive information from kernel heap memory via a broadcast message on the IPSec...

CVE-2013-2893

Summary of CVE-2013-2893 from provided sources : The Linux kernel HID subsystem (through version 3.11) with CONFIG_LOGITECH_FF, CONFIG_LOGIG940_FF, or CONFIG_LOGIWHEELS_FF enabled is vulnerable to a denial of service via a crafted USB HID device. The issue manifests as a heap-based out-of-bounds ...

CVE-2013-3301

CVE-2013-3301 affects the Linux kernel ftrace implementation up to version before 3.8.8. Local users with CAP_SYS_ADMIN can write to either set_ftrace_pid or set_graph_function and trigger an lseek, leading to a NULL pointer dereference and possible system crash or other impact. Multiple connecte...

CVE-2014-3181

CVE-2014-3181 affects the Linux kernel HID Magic Mouse driver (drivers/hid/hid-magicmouse.c, function magicmouse_raw_event) through version 3.16.3. It results in stack-based buffer overflows when processing large EHCI or XHCI data from a device, enabling physically proximate attackers to cause a ...

CVE-2014-8086

CVE-2014-8086 : A race condition in the Linux kernel’s ext4_file_write_iter (fs/ext4/file.c) up to version 3.17 can enable a local attacker to cause a denial of service (file unavailability) by racing a write action with an F_SETFL O_DIRECT flag operation. Affected software is the Linux kernel be...

CVE-2015-0274

The CVE-2015-0274 entry references the Linux kernel XFS flaw: before 3.15, the XFS implementation uses an old size value during remote attribute replacement, allowing a local attacker with XFS access to trigger a denial of service (transaction overrun/data corruption) and potentially escalate pri...