CVE-2025-21875

CVE-2025-21875 affects the Linux kernel MPTCP PM path. Connected docs describe a lock-order flaw where the PM can send RM_ADDR notifications over a msk socket without first acquiring the msk socket lock, allowing concurrent access to the PM removal/address path. The bug path follows PM removal of...

CVE-2025-37773

CVE-2025-37773 : In the Linux kernel, the virtiofs subsystem was updated to fix a NULL source-name in the filesystem context source name check. In fuzzing-like scenarios, the source name may be NULL, potentially triggering a kernel panic. The connected advisories confirm the issue and describe th...

CVE-2025-37793

CVE-2025-37793 affects the Linux kernel ASoC: Intel avs driver. The vulnerability arises when avs_component_probe() dereferences a NULL from devm_kasprintf() if memory allocation fails, leading to a NULL pointer dereference. A fix was implemented in the kernel to check for NULL from devm_kasprint...

CVE-2025-37852

CVE-2025-37852 affects the Linux kernel DRM/AMDGPU stack. The root cause is errors from amdgpu_cgs_create_device() in amd_powerplay_create(), which could lead to a null pointer dereference if not handled. The fix propagates the failure to the caller, releases the hwmgr, and returns -ENOMEM instea...

CVE-2025-37882

CVE-2025-37882 relates to a Linux kernel isochronous xHCI Ring handling race. The fix changes how xrun events are processed so that a TD queued at a ring position isn’t prematurely completed or warned about when the event TRB pointer can be NULL or a no-op. Triggering conditions include higher IR...

CVE-2025-37913

Summary: CVE-2025-37913 affects the Linux kernel’s net_sched/qfq when a netem child qdisc can cause the parent enqueue callback to be reentrant, risking memory corruption from adding the same classifier twice. The root cause is a double list add in the class when reentry occurs; the fix adds a gu...

CVE-2025-38129

CVE-2025-38129 details a Linux kernel use-after-free in page_pool_recycle_in_ring, linked to page_pool's per-CPU recycle mechanism. The root cause is that a page may be freed while the page pool’s ring is still being recycled, resulting in a potential use-after-free when the producer_lock is not ...

CVE-2026-31607

CVE-2026-31607 (Linux kernel USB/IP) : A RET_SUBMIT response can cause an out-of-bounds write when usbip_pack_ret_submit() overwrites urb->number_of_packets without validation. The loop bound in usbip_recv_iso()/usbip_pad_iso() then writes beyond urb->iso_frame_desc[], triggering a heap OOB...

CVE-2010-4157

CVE-2010-4157 involves an integer overflow in the Linux kernel’s GDTH SCSI driver (gdth_ioctl_alloc/ioc_general) on 64-bit platforms. A 32/64-bit mismatch when handling a large argument in an ioctl can cause memory corruption, enabling a local user to trigger a denial of service (and potentially ...

CVE-2012-3511

The CVE-2012-3511 entry maps to the Linux kernel issue in mm/madvise.c: madvise_remove contains race conditions that can be exploited locally to trigger use-after-free and kernel crash, resulting in denial of service via munmap or close. Affected lineage includes kernels before 3.4.5; patches add...

CVE-2012-6545

The CVE-2012-6545 issue affects the Linux kernel Bluetooth RFCOMM implementation. The connected MiracleLinux advisory documents this vulnerability as: before version 3.6, RFCOMM does not properly initialize certain structures, allowing a local attacker to obtain sensitive information from kernel ...

CVE-2013-4247

CVE-2013-4247: Off-by-one error in the Linux kernel fs/cifs/connect.c build_unc_path_to_root function (vulnerable before 3.9.6) can be triggered by a DFS share mount to cause memory corruption and system crash (Denial of Service). Multiple connected advisories (Unity Linux NES/USN entries and Ora...

CVE-2013-6382

CVE-2013-6382 refers to multiple buffer underflows in the Linux kernel’s XFS implementation up to version 3.12.1, allowing local, CAP_SYS_ADMIN–bearing users to trigger memory corruption or potential other impacts via the XFS_IOC_ATTRLIST_BY_HANDLE or XFS_IOC_ATTRLIST_BY_HANDLE_32 ioctls with cra...

CVE-2015-4001

CVE-2015-4001 family affects the OZWPAN driver in the Linux kernel (drivers/staging/ozwpan/ozhcd.c and related ozusbsvc1.c parsing paths) up to kernel 4.0.5. Root cause is integer signedness and length-field handling flaws in the OZWPAN stack, enabling remote attackers to cause denial of service ...

CVE-2018-11508

CVE-2018-11508 affects the Linux kernel’s compat_get_timex implementation in kernel/compat.c, allowing a local attacker to disclose kernel memory via adjtimex, with affected versions up to but before 4.16.9. The issue’s public fixes are documented in ChangeLog-4.16.9 and Ubuntu security advisorie...

CVE-2021-47203

CVE-2021-47203 concerns the Linux kernel SCSI lpfc driver. The description details a corruption in the lpfc_drain_txq() path where, if an adapter send fails, a local fail_msg is set and jobs are added to a completions list. Processing of subsequent jobs continues, and because fail_msg remains set...

CVE-2021-47633

CVE-2021-47633 is described in connected documents as a Linux kernel flaw in the ath5k driver where, during EEPROM parsing (ath5k_eeprom_read_pcal_info_5111), an out-of-bounds write could occur when no curve is selected in a loop, allowing idx to reach AR5K_EEPROM_N_PD_CURVES and causing pd to be...

CVE-2022-1678

CVE-2022-1678 affects Linux kernel 4.18–4.19, with memory/netns leaks due to improper sock reference handling in TCP pacing. Public Nessus/Unity advisories confirm the issue and reference kernel commits addressing the vulnerability; exploitation is described as remote via TCP pacing. Mitigation/r...

CVE-2022-2308

CVE-2022-2308 describes a vulnerability in the Linux kernel’s vDPA with the VDUSE backend. The VDUSE kernel driver does not validate that the device config space size matches the features advertised by the VDUSE userspace app, causing Virtio config read helpers to pass uninitialized memory to vdu...

CVE-2022-48796

CVE-2022-48796 relates to the Linux kernel iommu path where use-after-free can occur during device probe. The issue arises when freeing dev->iommu in dev_iommu_free while a deferred_probe_work_func accesses dev->iommu->fwspec in of_iommu_configure, leading to a KASAN use-after-free. The ...

CVE-2022-48982

CVE-2022-48982 affects the Linux kernel Bluetooth subsystem, specifically CSR fake controllers. The issue arises when a CSR 5.0 clone causes the suspend notifier to be registered twice, which can lead to a kernel panic during Bluetooth device probing (btusb/hci stack). The connected advisories an...

CVE-2022-49015

The CVE-2022-49015 entry concerns a Linux kernel use-after-free in the net: hsr path. The issue arises when a socket buffer (skb) delivered to netif_rx() may be freed, and subsequent dereferencing of skb could trigger a UAF. Affects the Linux kernel’s hsr subsystem (net: hsr) and is tied to skb l...

CVE-2022-49026

CVE-2022-49026 is a Linux kernel use-after-free in the e100 driver (e100_xmit_prepare) when skb mapping fails. The patch removes a harmful free, preventing UAF if the upper layer resends the skb. Reported in multiple advisories and OSS docs, the issue affects the kernel networking transmit path; ...

CVE-2022-49557

CVE-2022-49557 affects the Linux kernel in x86/fpu/KVM. The root cause is KVM’s guest FPU uABI size being set to the host default instead of KVM’s historic size, causing out-of-bounds writes to the XSAVE header when saving FPU state for guests on hosts without XSAVE. This can lead to data corrupt...

CVE-2023-38429

The CVE-2023-38429 issue is reported in the Linux kernel (pre-6.3.4) within ksmbd: fs/ksmbd/connection.c contains an off-by-one error in memory allocation (ksmbd_smb2_check_message), which can cause out-of-bounds access. Connected advisories (Astra Linux, Nessus plugin references) corroborate the...

CVE-2023-52991

CVE-2023-52991 applies to the Linux kernel net subsystem, specifically a NULL pointer dereference in skb_segment_list caused by frag_list being NULL after a GRO/GSO fraglist chaining change. The issue can lead to kernel panics during UDP/GSO processing when frag_list is unexpectedly pulled into t...

CVE-2023-53126

The CVE-2023-53126 entry concerns the Linux kernel mpi3mr SCSI driver: a memory leak in sas_hba.phy within mpi3mr_remove() is fixed, specifically freeing mrioc->sas_hba.phy at .remove. The vulnerability affects the kernel's SCSI MPI3MR path and was addressed by the fix; no exploit details are ...

CVE-2024-26647

CVE-2024-26647 affects the Linux kernel DRM/AMD display component. In link_set_dsc_pps_packet(), a dereference of struct display_stream_compressor *dsc could occur (dsc->ctx->logger) before a NULL pointer check, enabling a potential crash when the dsc pointer is NULL. The issue has been fix...

CVE-2024-27412

Technical details about CVE-2024-27412 (affected product, root cause, impact, fix) are not provided in the connected documents; public details are limited to the CVE description in the initial document.

CVE-2024-35829

CVE-2024-35829 affects the Linux kernel DRM Lima heap allocator. The issue is a memleak in lima_heap_alloc where, if lima_vm_map_bo fails, allocated resources were not properly deallocated, leading to memory leaks. Connected advisories (Astra Linux, Unity Nessus entry) confirm the same root cause...

CVE-2024-35860

CVE-2024-35860 : Linux kernel vulnerability in deferring bpf_link deallocation to after RCU grace period. When a bpf_link’s refcnt drops to zero, some active BPF programs could still access the link data via context, risking data access. The patch introduces two deallocation callbacks (synchronou...

CVE-2024-35885

Mode CThe CVE affects the mlxbf_gige Linux kernel driver. The issue is a NULL pointer dereference during shutdown in mlxbf_gige_handle_tx_complete, leading to kernel Oops and a fatal interrupt (kernel panic). It can leave NAPI enabled and the network interface in an inconsistent state if stop() i...

CVE-2024-35936

CVE-2024-35936. In the Linux kernel, the btrfs relocation code (btrfs_relocate_sys_chunks) contains an unhandled corruption case in its chunk-tree lookup loop. The issue arises from two theoretically impossible conditions: (1) an inexact search yields a key with offset -1 for a chunk-tree item, a...

CVE-2024-40934

CVE-2024-40934: In the Linux kernel, a memory leak was fixed in HID logitech-dj handling (logi_dj_recv_switch_to_dj_mode and logi_dj_recv_send_report error path). Impact is local and can cause leakage on vulnerable runs; fixes are documented in kernel stability updates referenced in the sources. ...

CVE-2024-40935

CVE-2024-40935 affects the Linux kernel cachefiles subsystem. In ondemand mode, when the cache is marked as CACHEFILES_DEAD, cachefiles_daemon_write() returns -EIO, preventing the daemon from passing the copen to the kernel and causing a hung_task for the waiting process. The fix requires flushin...

CVE-2024-41028

CVE-2024-41028 affects the Linux kernel (platform/x86) where the Toshiba ACPI quirk list lacked a terminating entry, causing an array out-of-bounds access during processing. The issue’s root cause is the missing terminating empty entry; remediation is to add the terminating entry. The CVSSv3.1 im...

CVE-2024-41069

CVE-2024-41069 is a Linux kernel vulnerability in ASoC topology where references to freed memory were fixed. The changelog entries indicate root cause was pointers into topology file contents after parsing and releasing memory; the fix allocates memory via devm_kmemdup() to avoid dereferencing fr...

CVE-2024-41074

Technical details for CVE-2024-41074 are not publicly available in the provided documents. Monitor for updates from vendors and security advisories.

CVE-2024-41088

CVE-2024-41088 (Linux kernel) affects the can mcp251xfd driver. When mcp251xfd_start_xmit() fails, tx_ring->head is still incremented, causing the Transmit Event FIFO to reflect an outstanding TX while a response is expected, which can lead to an infinite loop in the interrupt routine if multi...

CVE-2024-42106

CVE-2024-42106 : In the Linux kernel, the inet_diag path for raw sockets could read an uninitialized pad field in inet_diag_req_v2 when converting inet_diag_req to v2, leading to uninitialized reads in raw_lookup(). The root cause is that inet_diag_get_exact_compat() and inet_diag_dump_compat() d...

CVE-2024-43818

The CVE-2024-43818 issue is in the Linux kernel ASoC: amd code. acpi_get_first_physical_node() may return NULL in cases like absent device or ACPI errors, but the original check only emitted an error without returning. This could lead to a NULL dereference in devm_acpi_dev_add_driver_gpios(). The...

CVE-2024-46674

CVE-2024-46674 affects the Linux kernel USB/DWC3 ST platform path. The vulnerability stems from a probe error path that drops a platform device reference count due to an unused undo_platform_dev_alloc, causing unbalanced references and potential use-after-free when devm-managed resources are rele...

CVE-2024-46720

CVE-2024-46720 affects the Linux kernel; the issue is in the DRM AMDGPU path where a dereference after a null pointer check was fixed. The description from the initial document notes “drm/amdgpu: fix dereference after null check” and “check the pointer hive before use.” The connected Azure Linux ...

CVE-2024-46829

The CVE-2024-46829 entry affects the Linux kernel and concerns a deadlock condition in rtmutex handling. Root cause: rt_mutex_handle_deadlock() is invoked with rt_mutex::wait_lock still held; in the deadlock path this could lead to an endless scheduling loop while the lock remains held and trigge...

CVE-2024-46896

The CVE-2024-46896 vulnerability is in the Linux kernel DRM/AMDGPU path. It stems from a memset in drm_sched_job_init() that overwrites the initialized base.sched field in amdgpu_job_alloc, causing a CS validation path to be rejected with a bogus ring and potentially a crash. The fix passes NULL ...

CVE-2024-49887

CVE-2024-49887 targets the f2fs file system in the Linux kernel. Root cause: when injecting a fault for “no free segment,” the kernel could panic in __allocate_new_segment / get_new_segment, triggering a serious system halt. The description notes the issue was resolved by a fix that prevents pani...

CVE-2024-50005

CVE-2024-50005 affects the Linux kernel (mac802154) and is resolved by a fix in mac802154_scan_worker. The vulnerability arose from accessing scan_req->type after exiting the RCU read-side critical section, which can violate RCU rules and cause use-after-free or memory-access issues. The patch...

CVE-2024-50177

CVE-2024-50177 concerns the Linux kernel amdgpu display driver (DML2.1). The issue is a UBSAN shift-out-of-bounds triggered when programming phantom pipes and cursor_width is explicitly set to 0, causing an overflow in 32-bit size calculations. The published fix adds a guard to validate cursor wi...

CVE-2024-50178

Technical details (affected component, root cause, versions, or exploit status) are not provided in the connected documents; the initial description summarizes the fix but lacks vendor/product specifics in the supplied material. Monitor for authoritative advisories for updates.

CVE-2024-56563

CVE-2024-56563 corresponds to a Linux kernel exposure in Ceph’s MDS access check. The vulnerability arises in ceph_mds_check_access() where get_current_cred() increments the credentials reference count but a corresponding put_cred() may be missing, enabling a potential credential leak. The connec...