CVE-2022-49326

CVE-2022-49326 affects RTL818x wireless in Linux kernel (rtl8180/rtl8185/rtl8187se family). The issue arises from using not initialized tx queues, where reading ring->entries when zero can crash the kernel. The fix patches the driver to ignore priority for cards with a single TX queue and to p...

CVE-2024-50021

Technical details for CVE-2024-50021 are not publicly disclosed in the provided Connected documents. Monitor for updates from vendor/security advisories.

CVE-2024-50177

CVE-2024-50177 concerns the Linux kernel amdgpu display driver (DML2.1). The issue is a UBSAN shift-out-of-bounds triggered when programming phantom pipes and cursor_width is explicitly set to 0, causing an overflow in 32-bit size calculations. The published fix adds a guard to validate cursor wi...

CVE-2024-52559

CVE-2024-52559 affects the Linux kernel DRM MSM GEM submit path. The vulnerability arises from an integer overflow when user-supplied submit->cmd[i].size and submit->cmd[i].offset (u32) are processed, leading to wrapping. The fix switches to size_add() to prevent the overflow. Patch referen...

CVE-2024-56540

The CVE-2024-56540 entry concerns the Linux kernel, affecting the acceleration driver path for ivpu. It patches IPC send/receive flows to avoid triggering recovery during probe/resume by exposing ivpu_send_receive_internal() and adjusting ivpu_probe() and ivpu_resume() paths to propagate errors g...

CVE-2024-56725

CVE-2024-56725 : In the Linux kernel, the octeontx2-pf driver (otx2_dcbnl.c) contained an unchecked error pointer after calling otx2_mbox_get_rsp, potentially leading to a NULL-pointer dereference if the function returned an error. The public description and connected Astra Linux bulletin confirm...

CVE-2024-56764

Technical details about CVE-2024-56764 are not provided in the supplied documents. Monitor for publicly available details and updates.

CVE-2025-21634

CVE-2025-21634 concerns the Linux kernel cpuset/cgroup path where kernfs active protection can be broken during concurrent cpuset writes, triggering a warning and potential deadlock risk. The root cause involved a sequence of hotplug-related changes that async/sync cpuset processing and previousl...

CVE-2025-21674

CVE-2025-21674 affects the Linux kernel mlx5e/mlx5_core with IPsec tunnel offload in tunnel mode. The issue caused a kernel panic due to two problems: (1) in SA add, the _bh() variant should be used when marking SA mode, and (2) an unnecessary flush_workqueue in SA delete routine. The failure is ...

CVE-2025-21720

CVE-2025-21720 : Linux kernel xfrm: delete intermediate secpath entry in packet offload mode. When IP forwarding is enabled, secpath may not be removed, causing offloaded packets to re-enter the TX path with xfrm_offload set and can trigger a kernel NULL pointer dereference kernel panic in mlx5. ...

CVE-2025-21870

CVE-2025-21870 affects the Linux kernel ASoC: SOF ipc4-topology. Root cause: when non-DAI copier widgets share the same stream name as the ALH copier, copier->data can be NULL, risking a NULL pointer dereference. The patch/mitigation described hardens the matching logic by ensuring two conditi...

CVE-2025-21884

CVE-2025-21884 concerns the Linux kernel topic “net: better track kernel sockets lifetime.” The description in Astra Linux and related Nessus references show the issue arises because kernel sockets freed during pernet_operations->exit() can be delayed by remaining tx packets in qdisc/device qu...

CVE-2025-22016

CVE-2025-22016 affects the Linux kernel (dpll: fix xa_alloc_cyclic() error handling). The issue: returning ERR_PTR(1) from xa_alloc_cyclic() could cause IS_ERR() to be false, risking dereference of an unallocated pointer. Fix implemented by ensuring err is

CVE-2025-22085

CVE-2025-22085 affects the Linux kernel RDMA/core. The description documents a use-after-free (slab) in the netlink/name rename path, caused by a use-after-free in nla_put during device-name rename handling. The issue manifests as a slab-use-after-free Read in nla_put, traced through netlink/nlde...

CVE-2025-22118

Linux kernel vulnerability CVE-2025-22118 affects the ice driver where queue quanta parameters could lead to out-of-bounds access. The fix adds queue wraparound prevention in quanta configuration and ensures end_qid cannot overflow by validating start_qid and num_queues. This is a local-privilege...

CVE-2025-37886

CVE-2025-37886 : In the Linux kernel, the pds_core path updated to make the wait_context a full part of the q_info struct instead of a stack variable. The bug occurred when a slow development firmware caused an adminq request to time out, and after the wait loop, a completion context on the stack...

CVE-2025-37957

CVE-2025-37957 describes a Linux kernel KVM/VMX issue where, if a VM enters SMM via KVM_SMI and then encounters invalid instructions leading to exceptions, forcing a vCPU reset during SHUTDOWN interception can trigger a WARN in kvm_vcpu_reset due to the vCPU being in SMM. The root cause is omissi...

CVE-2025-37967

CVE-2025-37967 affects the Linux kernel USB Type-C UCSI driver (displayport) and fixes a deadlock when handling DP Alt Mode. The patch adds ucsi_con_mutex_lock and ucsi_con_mutex_unlock so the connector mutex is only acquired when a connection exists and the partner pointer is valid, preventing a...

CVE-2025-37968

CVE-2025-37968 (Linux kernel) affects the iio: light: opt3001 driver. The issue is a deadlock in a threaded IRQ path caused by reading the same flag twice (once for mutex_lock, once for mutex_unlock). The fix standardizes the flag handling by reading it into a local variable and reusing that valu...

CVE-2025-37982

CVE-2025-37982 affects the Linux kernel wifi driver wl1251 (wl1251_tx_work path). The vulnerability is a memory leak: when wl1251_ps_elp_wakeup fails with -ETIMEDOUT, the skb dequeued from tx_queue is lost. The advisory/connected Azure Nessus entry confirms the fix: the skb must be re-queued back...

CVE-2010-4656

CVE-2010-4656 affects the Linux kernel’s USB iowarrior driver (drivers/usb/misc/iowarrior.c). The root cause is improper buffer/memory allocation in iowarrior_write, enabling a heap-based buffer overflow via a long report from a malicious device. This aligns with openSUSE/SUSE advisories noting a...

CVE-2011-1076

CVE-2011-1076 affects the Linux kernel up to 2.6.37 in dns_key.c; remote DNS servers sending invalid responses can trigger a NULL pointer dereference/OOPS, leading to a denial of service. Reports from SUSE/Red Hat/NVD corroborate. Remediation: upgrade to kernel 2.6.38 or newer (vendor patches). E...

CVE-2011-2492

CVE-2011-2492 affects the Linux kernel Bluetooth subsystem prior to 3.0-rc4, where certain data structures are not properly initialized. The flaw is exploited via a crafted getsockopt system call in the l2cap_sock_getsockopt_old and rfcomm_sock_getsockopt_old paths, enabling local users to obtain...

CVE-2012-0207

CVE-2012-0207 affects the Linux kernel before 3.2.1, where igmp_heard_query in net/ipv4/igmp.c can be triggered by IGMP packets to cause a divide-by-zero leading to a kernel panic (DoS). The vulnerability is addressed in Linux 3.2.1 (as per ChangeLog-3.2.1). Connected advisories/Nessus entries re...

CVE-2012-2319

CVE-2012-2319 refers to multiple buffer overflows in the Linux kernel’s hfsplus filesystem implementation, exploitable locally to gain privileges via a crafted HFS+ filesystem. Affected: Linux kernel before 3.3.5. Root cause: buffer overflow in hfsplus code (related to CVE-2009-4020). Impact, as ...

CVE-2013-0914

The CVE-2013-0914 issue affects the Linux kernel (before 3.8.4) where the function flush_signal_handlers in kernel/signal.c preserves the sa_restorer field across an exec. This behavior enables local users to bypass ASLR via a crafted application using sigaction. Exploitation details are not prov...

CVE-2014-9728

CVE-2014-9728 concerns the Linux kernel UDF filesystem before 3.18.2, where missing validation of certain lengths in fs/udf/inode.c and fs/udf/symlink.c can enable a local attacker to trigger a denial of service via a crafted UDF image, potentially causing a buffer over-read and system crash. The...

CVE-2014-9904

CVE-2014-9904 affects the Linux kernel ALSA subsystem: snd_compress_check_input in sound/core/compress_offload.c before 3.17 fails to check for an integer overflow. This can allow local users to cause a denial of service (insufficient memory allocation) or other unspecified impact via a crafted S...

CVE-2016-3713

CVE-2016-3713 affects the Linux kernel up to version 4.6.0 (fixed in 4.6.1). The vulnerability lies in msr_mtrr_valid() in arch/x86/kvm/mtrr.c, which incorrectly supports MSR 0x2f8 and allows a guest OS user to read or write the kvm_arch_vcpu data structure. Impact includes potential information ...

CVE-2016-8636

The CVE-2016-8636 issue affects the Linux kernel’s mem_check_range path in drivers/infiniband/sw/rxe/rxe_mr.c, where an integer overflow can occur. This vulnerability in Soft RoCE (RDMA over InfiniBand) allows local users to trigger memory corruption, potentially cause a denial of service, and ma...

CVE-2018-13098

CVE-2018-13098 applies to the Linux kernel’s F2FS implementation, specifically fs/f2fs/inode.c up to version 4.17.3. The issue is a denial-of-service condition caused by a slab out-of-bounds read and a BUG when FI_EXTRA_ATTR is set in an inode of a modified F2FS image. Connected Nessus advisories...

CVE-2020-36780

Mode C: The CVE-2020-36780 issue concerns the Linux kernel i2c Sprd driver. The root cause is a reference leak where pm_runtime_get_sync increments the device PM reference count on return even when the operation failed, in sprd_i2c_master_xfer() and sprd_i2c_remove(). The fix replaces the increme...

CVE-2021-4442

CVE-2021-4442 – The Linux kernel TCP stack vulnerability described as: a syzkaller repro could cause RCV_SEQ to be advanced after data restoration in the receive queue, enabling an out-of-order or invalid sequence handling when TCP_QUEUE_SEQ is used on non-empty queues. The connected documents (A...

CVE-2021-46982

CVE-2021-46982 relates to the Linux kernel’s f2fs compress path. A race between truncate and overwrite can leave a reference on a page, causing find_lock_page to return NULL after truncation. Root cause involves prepare_compress_overwrite, f2fs_pagecache_get_page, and subsequent truncate_setsize/...

CVE-2021-47238

CVE-2021-47238 involves a memory-leak in the Linux kernel IPv4 multicast path (ip_mc_add1_src) that occurs when manipulating IGMP source lists. The root cause is a leak in ip_mc_add1_src/ip_mc_add_src handling of in_dev->mc_list->sources, described in the advisory. The linked commits and di...

CVE-2021-47534

The CVE-2021-47534 entry concerns a Linux kernel DRM/VC4 KMS issue: a refcounting bug in the global HVS state caused leakage of drm_crtc_commit structures on every commit. The fix introduces drm_crtc_commit_put to prevent leakage, implemented in the patch chain around commit 9ec03d7f1ed3. Affecte...

CVE-2021-47595

CVE-2021-47595 affects the Linux kernel net/sched sch_ets. The vulnerability arises when the ETS qdisc changes (ets_qdisc_change) cause list_del corruption, leading to kernel BUG checks (invalid opcode in list_debug.c) and a system crash. The provided traces show the crash occurs in ets_qdisc_cha...

CVE-2022-3544

CVE-2022-3544 describes a memory leak in the Linux kernel within Netfilter, specifically the damon_sysfs_add_target function in mm/damon/sysfs.c. The issue is triggered through manipulation of target handling and is described as a vulnerability in the kernel’s Netfilter component. The initial des...

CVE-2022-48951

The CVE-2022-48951 vulnerability is in the Linux kernel ASoC path: snd_soc_put_volsw_sx() does bounds checks only for the first channel, allowing potential out-of-bounds writes to the second channel in stereo controls. This is fixed upstream by adding proper checks (e.g., kernel commits cf611d......

CVE-2022-48967

CVE-2022-48967 affects the Linux kernel NFC subsystem (NCI) and stems from a missing bounds check in nci_add_new_protocol, allowing a potential field-spanning write to target->sensf_res under Fortify and triggering an out-of-bounds write. The issue is concrete: a bounds error in net/nfc/nci/nt...

CVE-2022-49035

CVE-2022-49035 in the Linux kernel affects media: s5p_cec by not consistently limiting msg.len to CEC_MAX_MSG_SIZE. Root cause is the len check not enforced in all code paths, potentially enabling a corner-case that could impact availability (per CVSS: LOCAL, HIGH impact to availability; I/I/C = ...

CVE-2022-49228

CVE-2022-49228 relates to the Linux kernel and a bug in BTF decl_tag handling during function tagging in BPF. The issue arises when btf_decl_tag_resolve() checks a function type’s func_proto; the code attempted to access func_proto’s vlen for a type 3 function prototype, which was out of range an...

CVE-2022-49334

The CVE-2022-49334 issue concerns the Linux kernel memory-management code for huge pages (mm/huge_memory). The root cause was that when xas_split_alloc() could not allocate required xarray nodes, it set xa_state to -ENOMEM, which xas_nomem() treated as a cue to “Please allocate more memory,” inst...

CVE-2022-49377

CVE-2022-49377 is a Linux kernel vulnerability in the block multi-queue (blk-mq) path. The root cause was a use-after-free involving ->tagset during blk_mq_run_hw_queues, when there were no queued requests and the tagset could be freed after blk_cleanup_queue. The fix disables touching tagset ...

CVE-2023-4611

CVE-2023-4611 is a use-after-free in the Linux kernel memory subsystem (mm/mempolicy.c) caused by a race between mbind() and VMA-locked page fault. The vulnerability could allow a local attacker to crash the system or leak kernel information. Connected sources confirm the affected component and t...

CVE-2023-46343

CVE-2023-46343 concerns the Linux kernel up to version 6.5.9, with a NULL pointer dereference in send_acknowledge (net/nfc/nci/spi.c). Affected component: kernel. Root cause: NULL pointer dereference in send_acknowledge. Explicit impact details in the provided metrics show Confidentiality and Int...

CVE-2023-52769

CVE-2023-52769 concerns the Linux kernel wireless driver ath12k. The issue arises in the htt_mlo_offset event handling path, where the code calling ath12k_mac_get_ar_by_pdev_id() was not protected by an RCU read-side critical section, potentially enabling use-after-free in active pdev contexts. T...

CVE-2023-52994

Summary (CVE-2023-52994): In the Linux kernel, suspending a system under Xen PV could dereference NULL due to a missed code path in acpi_get_wakeup_address, caused by the commit that skipped realmode init for Xen PV guests. The fix adds an optional ACPI callback to skip setting the wakeup address...

CVE-2024-22705

The CVE CVE-2024-22705 affects ksmbd in the Linux kernel prior to 6.6.10. It is caused by an issue in smb2_get_data_area_len (fs/smb/server/smb2misc.c) where the relationship between Name data and CreateContexts data can lead to an out-of-bounds access in smb_strndup_from_utf16. This is a local i...

CVE-2024-26714

CVE-2024-26714 affects the Linux kernel interconnect/qcom sc8180x module. Root cause: CO0 BCM must stay up as a keepalive to prevent hardware such as the UFS controller from losing connectivity, which can hang the platform and trigger heavy logspam. Documented fix marks CO0 BCM keepalive to ensur...