CVE-2015-8844

CVE-2015-8844 affects the Linux kernel on PowerPC where the signal implementation does not validate an MSR with both the S and T bits set. This can enable a local attacker to cause a denial of service (TM Bad Thing exception and panic) via a crafted application. The vulnerability is fixed in the ...

CVE-2016-5243

CVE-2016-5243 affects the Linux kernel up to 4.6.3. The tipc_nl_compat_link_dump function in net/tipc/netlink_compat.c does not properly copy a string, enabling a local attacker to read sensitive data from kernel stack memory via a Netlink message. Impact is information disclosure with LOCAL acce...

CVE-2016-8660

CVE-2016-8660 affects the Linux kernel XFS subsystem up to version 4.8.2. A local attacker can trigger a denial of service (fdatasync failure and system hang) by using the vfs syscall group in the Trinity program, due to a page lock order bug in the XFS seek hole/data implementation. The root cau...

CVE-2017-17053

CVE-2017-17053 affects the Linux kernel, specifically the init_new_context code path in arch/x86/include/asm/mmu_context.h, for kernels built with CONFIG_MODIFY_LDT_SYSCALL=y. Before 4.12.10, errors from LDT table allocation when forking a new process are not handled correctly, enabling a local a...

CVE-2017-17863

CVE-2017-17863 affects the Linux kernel 4.9.x up to 4.9.71, where the BPF verifier in kernel/bpf/verifier.c fails to check the relationship between pointer values and the BPF stack. This can allow local users to trigger a denial of service (integer overflow or invalid memory access) or potentiall...

CVE-2018-25015

CVE-2018-25015 affects the Linux kernel up to version 4.14.15, with a use-after-free in net/sctp/socket.c when a lock is held after a peel-off (CID-a0ff660058b8). Exploitation details are not provided in the supplied documents, but CVSS v3 indicates a high impact. The ChangeLog entry for 4.14.16 ...

CVE-2018-5703

The CVE-2018-5703 issue affects the Linux kernel’s IPv6 stack, specifically tcp_v6_syn_recv_sock in net/ipv6/tcp_ipv6.c, through version 4.14.11. It enables a slab out-of-bounds write that can cause denial of service (DoS) and potentially other impacts via TLS-related vectors. Multiple vendor adv...

CVE-2019-18813

CVE-2019-18813 is tied to a memory leak in the Linux kernel’s dwc3_pci_probe() (drivers/usb/dwc3/dwc3-pci.c). The issue is present in kernel versions up to 5.3.9 and allows a remotely-triggered denial of service by causing memory consumption when platform_device_add_properties() fails. The connec...

CVE-2021-47056

CVE-2021-47056 affects Linux kernel components involving the Intel QAT crypto path (qat_dh895xccvf, adf_iov_putmsg, adf_vf2pf_shutdown). The issue is that ADF_STATUS_PF_RUNNING was set unconditionally; vf2pf_lock is initialized in adf_dev_init() and may be uninitialized/destroyed if init fails, l...

CVE-2021-47138

In CVE-2021-47138, the Linux kernel cxgb4 driver is vulnerable because hardware registers for the server TID base can hold invalid values when the adapter is in a bad state (e.g., AER fatal error). Reading these values during filter clearing could cause out-of-bounds memory access. The fix uses t...

CVE-2021-47315

CVE-2021-47315 affects the Linux kernel memory driver fsl_ifc (fsl_ifc_ctrl_probe). The issue is a leak of IO memory on probe failure due to not releasing gregs on error, as reported by Smatch. The resolved description states the fix is to unmap the IO memory when probe errors occur. The impact d...

CVE-2021-47402

CVE-2021-47402 affects the Linux kernel’s net: sched: flower (cls_flower). The issue arises from a use-after-free when filters are deleted concurrently due to missing RCU protection during fl_walk() iteration after a patch refactor. The provided advisories state that fl_walk() must obtain the RCU...

CVE-2022-3112

CVE-2022-3112 affects the Linux kernel up to 5.16-rc6. The issue is in amvdec_set_canvases (drivers/staging/media/meson/vdec/vdec_helpers.c) where kzalloc() return value is not checked, leading to a NULL pointer dereference. Connected sources confirm the same defect across various advisories (e.g...

CVE-2022-40476

CVE-2022-40476: A NULL pointer dereference in fs/io_uring.c of the Linux kernel prior to 5.15.62 allows a local user to crash the system or potentially cause a denial of service. Affected software: Linux kernel (pre-5.15.62). Root cause: NULL pointer dereference in io_uring handling. Impact: loca...

CVE-2022-49441

CVE-2022-49441 relates to a Linux kernel deadlock in tty handling. The root cause is a potential deadlock when kmalloc() path could trigger a printk() while holding tty_port->lock, enabling a cycle with console ownership locks. The described failing scenario involves multiple CPUs acquiring po...

CVE-2022-49795

The CVE-2022-49795 entry pertains to the Linux kernel: in rethook_alloc(), the local variable rh could be leaked if handler is NULL, causing a potential memory leak. The issue is described as a memleak in rethook_alloc(), which is resolved by the fix. Connected documents (e.g., SUSE OSV entries a...

CVE-2023-3865

CVE-2023-3865 affects the ksmbd component of the Linux kernel (smb2_write). Root cause: ksmbd_smb2_check_message does not validate hdr->NextCommand; if NextCommand > Offset+Length of smb2 write, an oversized length allows an out-of-bounds read in smb2_write. Implication: out-of-bounds read ...

CVE-2023-52576

CVE-2023-52576 affects the Linux kernel (x86/mm, kexec, ima). The issue was a use-after-free in memblock_isolate_range() caused by calling ima_free_kexec_buffer() after the memblock allocator had been torn down. The fix switches ima_free_kexec_buffer() to memblock_free_late() to avoid the bug. Wi...

CVE-2023-52582

CVE-2023-52582 affects the Linux kernel netfs path. The issue is in netfs_rreq_unlock_folios() where folio_start_fscache() could be invoked more than once per folio when a clamp_length() is used, potentially triggering an oops as described in the public advisory. The connected advisories confirm ...

CVE-2023-52763

The CVE-2023-52763 issue concerns the Linux kernel i3c master driver (i3c: master: mipi-i3c-hci). The root cause is a use-after-init sequence: i3c_master_bus_init may attach I2C devices before the I3C bus is initialized, causing the DAT_data alloc_entry to be used before init, and, if init fails,...

CVE-2023-52771

CVE-2023-52771 affects the Linux kernel CXL stack. The issue is a race between delete_endpoint() teardown and parent unregistration, which can impact the cxl_mem/cxl_port topology during port removal. The provided description states two fixes: (1) acquire a reference on the parent to prevent use‑...

CVE-2023-52916

CVE-2023-52916 affects the Linux kernel’s media: aspeed driver. When displaying 1600x900 and memory is tight, the macro block capture can cause a system crash due to a memory overwrite; the issue is tied to an 8x8 block sizing, fixed by aligning the src-buf height to 8. The CVSS v3.1 base score i...

CVE-2023-52925

CVE-2023-52925 relates to the Linux kernel nf_tables code. The vulnerability concerns how nf_tables handles inserts for duplicate set entries when some duplicates have expired. The description states that the system should ignore expired duplicates and not fail inserts, noting an asymmetry in nft...

CVE-2023-53060

CVE-2023-53060 concerns the igb driver in the Linux kernel. The description shows a data-race concern was introduced by a patch that added a lock via rtnl_lock to avoid a race between igb_remove/igb_ndo_get_vf_config and igb_disable_sriov paths, but this lock created a deadlock scenario during de...

CVE-2023-53065

CVE-2023-53065 is a Linux kernel vulnerability in perf/core where perf_output_begin was invoked with an incorrect parameter in perf_event_bpf_output. Syzkaller reported a KASAN stack-out-of-bounds issue, traced through __perf_event_header__init_id, causing memory overwrites. The root cause is the...

CVE-2023-53124

VULNERABILITY SUMMARY: CVE-2023-53124 fixes a NULL pointer dereference in the Linux kernel SCSI driver mpt3sas during transport_port_add. The port is created by sas_port_alloc_num() and rphy by sas_end_device_alloc() or sas_expander_alloc(), any of which may return NULL, and the code would access...

CVE-2023-53134

CVE-2023-53134 is a Linux kernel issue affecting the bnxt_en driver where 4K-page systems could experience memory-allocation failure when tracking concurrent TPA (GRO/LRO) completions on 4K pages (up to 256 on P5). The root cause was an order-5 allocation for TPA data. The patch changes allocatio...

CVE-2024-26790

The CVE-2024-26790 issue affects the Linux kernel, specifically the dmaengine: fsl-qdma path. It describes a vulnerability where 16-byte unaligned read transactions by QDMA on ls1028a-based SoCs can stall the Network On-Chip (NOC) and trigger PCIe controller timeouts, potentially causing a deadlo...

CVE-2024-26807

CVE-2024-26807 is a Linux kernel issue in the cadence-quadspi driver where the runtime suspend/resume paths incorrectly retrieve a spi_controller pointer via dev_get_drvdata, potentially using a cqspi_st instead of a spi_controller. This mismatch can cause memory corruption and kernel crashes dur...

CVE-2024-26818

CVE-2024-26818 affects the Linux kernel (rtla/ utils.c) where a fscanf call uses mount_point with a size of MAX_PATH but the format can write up to MAX_PATH+1, risking a buffer overflow. The connected Astra/Tencent/Tenable data confirms the root cause and documents the fix: increase the mount_poi...

CVE-2024-36918

The CVE-2024-36918 issue affects the Linux kernel’s BPF bloom filter map: a missing check allowed value sizes that overflow int, risking kernel crashes. A patch rejects values above KMALLOC_MAX_SIZE during bloom filter creation; this aligns bloom map protection with other map types. The vulnerabi...

CVE-2024-36925

CVE-2024-36925 affects the Linux kernel SWIOTLB path. When CONFIG_DMA_RESTRICTED_POOL=y and CONFIG_SWIOTLB_DYNAMIC=y, initialising restricted pool memory could crash due to a NULL mem->pools during add_mem_pool() in rmem_swiotlb_device_init(). The crash arises from a NULL pointer dereference i...

CVE-2024-38384

CVE-2024-38384 (Linux kernel) - The blk-cgroup subsystem had a race where reordering WRITE to the lqueued field with a READ of bisc->lnode.next inside __blkcg_rstat_flush() could corrupt a local list. The issue could occur anytime __blkcg_rstat_flush() runs, especially during blk_cgroup_bio_st...

CVE-2024-38577

CVE-2024-38577 affects the Linux kernel (rcu-tasks: show_rcu_tasks_trace_gp_kthread). The issue is a potential buffer overflow when counters passed to sprintf() are unrealistically large; the fix replaces sprintf() with snprintf() using a bounded buffer. Patches are incorporated in various adviso...

CVE-2024-38591

CVE-2024-38591 affects the Linux kernel RDMA/hns driver. The issue is a deadlock in SRQ handling during asynchronous events: xa_lock for the SRQ table may be required in AEQ, and the patch uses xa_store_irq() / xa_erase_irq() to avoid deadlock. Documentation confirms the vulnerability is resolved...

CVE-2024-39509

CVE-2024-39509 is a Linux kernel local vulnerability in HID core: implement() where a WARN_ON() was considered superfluous and removed to prevent syzkaller warnings in hid-core.c/hid_output_report. The issue arises when writing a value into a field of smaller size; the value is already masked and...

CVE-2024-40900

CVE-2024-40900 affects the Linux kernel cachefiles path: a use-after-free can occur where requests are not removed from cache->reqs during flushing, allowing access to freed REQ objects in a concurrent flush scenario. The described sequence shows a freed req being accessed by cachefiles_ondema...

CVE-2024-40915

The CVE-2024-40915 issue affects the Linux kernel on riscv, where __kernel_map_pages() (a debugging page-table helper) used __set_memory() to flip the valid bit of page-table entries. __set_memory() takes init_mm’s semaphore and can sleep, but __kernel_map_pages() may be called in atomic context,...

CVE-2024-42076

The CVE-2024-42076 entry relates to the Linux kernel net/can/j1939 path, where j1939_send_one() allocated a full frame but did not initialize unused data, enabling a kernel-infoleak via raw_recvmsg() paths observed by syzbot. The root cause is uninitialized memory in the frame allocation (Bytes 1...

CVE-2024-42095

CVE-2024-42095 affects the Linux kernel component serial: 8250_omap, implementing Errata i2310. The issue allows an erroneous timeout that, if not cleared, can trigger a storm of interrupts per TI’s Errata i2310 (TI TI sprz536, page 23). Public records in connected sources consistently cite imple...

CVE-2024-42126

CVE-2024-42126 pertains to the Linux kernel on powerpc where nmi_enter/nmi_exit can touch per-CPU state and crash the kernel when invoked during real-mode interrupt handling if percpu allocations come from the vmalloc area. The issue manifests under CONFIG_NEED_PER_CPU_PAGE_FIRST_CHUNK with percp...

CVE-2024-43837

CVE-2024-43837 (Linux kernel): The vulnerability is a null pointer dereference in BPF EXT program type resolution when dst_prog is not attached. The fix, as described in the primary document, changes resolve_prog_type() to return prog->type for BPF_PROG_TYPE_EXT when dst_prog is absent, instea...

CVE-2024-46739

The CVE-2024-46739 issue is in the Linux kernel (uio_hv_generic) and affects hv_uio_rescind for VM Bus channels. Root cause: the primary_channel pointer is NULL for primary channels and rescind callbacks are meant for primary channels only, leading to a NULL pointer dereference. The fix retrieves...

CVE-2024-46829

The CVE-2024-46829 entry affects the Linux kernel and concerns a deadlock condition in rtmutex handling. Root cause: rt_mutex_handle_deadlock() is invoked with rt_mutex::wait_lock still held; in the deadlock path this could lead to an endless scheduling loop while the lock remains held and trigge...

CVE-2024-47720

CVE-2024-47720 in the Linux kernel relates to the AMD display path (drm/amd/display) where dcn30_set_output_transfer_func dereferenced set_output_gamma without a null check. The patch adds a nullity check for set_output_gamma before calling it and logs an error if it is NULL, preventing a potenti...

CVE-2024-49853

CVE-2024-49853 affects the Linux kernel firmware/arm_scmi path (OPTEE transport). The issue is a double-free in the OPTEE transport where channel descriptors can be freed twice when unloading the stack, due to channels being shared between protocols. This can lead to memory corruption or potentia...

CVE-2024-49980

CVE-2024-49980 affects the Linux kernel VRF path. The issue stems from removing an RCU-bh critical section around dev_queue_xmit_nit, which violated an invariant and could cause an inconsistent lock state, potentially enabling a deadlock during packet reception when BH is disabled. The vulnerabil...

CVE-2024-50021

Technical details for CVE-2024-50021 are not publicly disclosed in the provided Connected documents. Monitor for updates from vendor/security advisories.

CVE-2024-50177

CVE-2024-50177 concerns the Linux kernel amdgpu display driver (DML2.1). The issue is a UBSAN shift-out-of-bounds triggered when programming phantom pipes and cursor_width is explicitly set to 0, causing an overflow in 32-bit size calculations. The published fix adds a guard to validate cursor wi...

CVE-2024-52559

CVE-2024-52559 affects the Linux kernel DRM MSM GEM submit path. The vulnerability arises from an integer overflow when user-supplied submit->cmd[i].size and submit->cmd[i].offset (u32) are processed, leading to wrapping. The fix switches to size_add() to prevent the overflow. Patch referen...