CVE-2018-25015

CVE-2018-25015 affects the Linux kernel up to version 4.14.15, with a use-after-free in net/sctp/socket.c when a lock is held after a peel-off (CID-a0ff660058b8). Exploitation details are not provided in the supplied documents, but CVSS v3 indicates a high impact. The ChangeLog entry for 4.14.16 ...

CVE-2025-21696

CVE-2025-21696 (Linux kernel) : Affects memory management with userfaultfd (UFFD). When mremap() moves a region previously registered with UFFD_WP but without UFFD_FEATURE_EVENT_REMAP, the code could fail to clear uffd-wp on PTE/PMD, causing a mismatch between vma flags (UFFD_WP cleared) and PTE/...

CVE-2025-21729

The CVE-2025-21729 vulnerability affects the Linux kernel wifi driver rtw89 (rtwdev) with a race between cancel_hw_scan and hw_scan completion. Root cause: rtwdev->scanning was not mutex-protected, allowing cancel_hw_scan to observe/modify state while hw_scan completion could unset the flag an...

CVE-2025-21790

CVE-2025-21790 fixes a kernel-space issue in the vxlan code. The vulnerable path is in vxlan_vnigroup_init() not being checked by vxlan_init(), which can lead to a NULL dereference or general protection fault later when vxlan_dev is created/unregistered (local attacker with access to the kernel c...

CVE-2025-21809

Technical details for CVE-2025-21809 are not publicly available in the provided connected documents; monitor for official advisories or vendor updates for affected products, impact, and fixes.

CVE-2025-21810

Technical details for CVE-2025-21810 are not publicly available in the provided connected documents. Monitor kernel advisories and vendor advisories for affected versions, impact, and fixes.

CVE-2025-22107

CVE-2025-22107 - Linux kernel (net: dsa: sja1105) Root cause: in sja1105_table_delete_entry, deleting the last element in the table incorrectly calls memmove over an out-of-bounds element, and the number of elements moved should be size - i - 1. This leads to touching an out-of-bounds memory loca...

CVE-2025-23133

The CVE-2025-23133 issue is in Linux kernel ath11k: when a new channel list is received, it updates cfg80211 and queues reg_work, but may immediately execute reg_update_chan_list() before cfg80211 finishes handling the list, causing a potential slab-out-of-bounds write (KASAN) in ath11k_reg_updat...

CVE-2025-37807

CVE-2025-37807 is a Linux kernel issue in the BPF percpu hashmap path where a percpu pointer is stored at an 8-byte aligned location only if the key_size rounds up to 8; otherwise a 4-byte aligned location is used, causing kmemleak to miss the pointer and report a leak. The root cause is an align...

CVE-2025-37967

CVE-2025-37967 affects the Linux kernel USB Type-C UCSI driver (displayport) and fixes a deadlock when handling DP Alt Mode. The patch adds ucsi_con_mutex_lock and ucsi_con_mutex_unlock so the connector mutex is only acquired when a connection exists and the partner pointer is valid, preventing a...

CVE-2025-38248

CVE-2025-38248 : In the Linux kernel, a use-after-free flaw occurs in bridge multicast routing port handling. When per-VLAN multicast snooping is active, per-port multicast context is disabled and ports are removed from the global router port list, but can be re-added, leaving stale entries. This...

CVE-2025-38477

The CVE-2025-38477 entry concerns a race in the Linux kernel’s net/sched qfq code. A concurrent modification of agg in qfq_change_agg (invoked during qfq_enqueue) could lead to a NULL dereference in qfq_dump_class and a use-after-free in qfq_delete_class. The fix moves qfq_destroy_class into the ...

CVE-2008-4307

CVE-2008-4307 is a Linux kernel local-denial-of-service issue caused by a race in do_setlk (fs/nfs/file.c) where improper handling of a race between fcntl and close in the EINTR path can crash the kernel and leave a stray FL_POSIX lock. Affected product: Linux kernel versions before 2.6.26. The v...

CVE-2011-1090

CVE-2011-1090 affects the Linux kernel’s NFSv4 ACL handling: the function __nfs4_proc_set_acl in fs/nfs/nfs4proc.c allocates memory with kmalloc but does not always free it, enabling a local attacker to trigger a denial of service (panic) by crafting an ACL set operation. The vulnerability is doc...

CVE-2011-1172

The CVE-2011-1172 issue affects the Linux kernel IPv6 stack (net/ipv6/netfilter/ip6_tables.c): root cause is failure to append a null terminator to certain string values, enabling local memory information disclosure via a crafted request (CAP_NET_ADMIN) and reading the modprobe argument. Impact i...

CVE-2011-2213

The CVE-2011-2213 issue concerns the Linux kernel vulnerability in inet_diag_bc_audit (net/ipv4/inet_diag.c) present before 2.6.39.3. Affected component audits INET_DIAG bytecode and, when processing crafted INET_DIAG_REQ_BYTECODE messages (e.g., an INET_DIAG_BC_JMP with a zero yes value), allows...

CVE-2011-2918

CVE-2011-2918 affects the Linux kernel perf subsystem (Performance Events). The issue arises in the handling of event overflows for PERF_COUNT_SW_CPU_CLOCK, enabling a local attacker to cause a denial of service (system hang) via a crafted application. Public references in connected advisories co...

CVE-2011-5321

The vulnerability CVE-2011-5321 affects the Linux kernel up to version 3.1.0, specifically the tty_open function in drivers/tty/tty_io.c, where a driver-lookup failure can lead to a NULL pointer dereference and system crash via crafted access to /dev/pts devices. Local users can cause a denial of...

CVE-2012-1601

CVE-2012-1601 concerns the KVM component of the Linux kernel. The vulnerability exists in the KVM implementation prior to version 3.3.6 and can be triggered by a host OS user making a KVM_CREATE_IRQCHIP ioctl after a virtual CPU already exists. The issue may lead to a NULL pointer dereference and...

CVE-2013-0231

CVE-2013-0231 is discussed in connected advisories as affecting the Xen PCI backend: the pciback_enable_msi function in drivers/xen/pciback/conf_space_capability_msi.c on Linux kernels 2.6.18 and 3.8 allows guest OS users with PCI device access to trigger a denial of service by generating a large...

CVE-2013-2888

CVE-2013-2888 : The Linux kernel HID subsystem contains multiple array index errors in drivers/hid/hid-core.c that can be triggered by a crafted HID device providing an invalid Report ID. The vulnerability allows physically proximate attackers to execute arbitrary code or cause a denial of servic...

CVE-2013-3301

CVE-2013-3301 affects the Linux kernel ftrace implementation up to version before 3.8.8. Local users with CAP_SYS_ADMIN can write to either set_ftrace_pid or set_graph_function and trigger an lseek, leading to a NULL pointer dereference and possible system crash or other impact. Multiple connecte...

CVE-2015-4001

CVE-2015-4001 family affects the OZWPAN driver in the Linux kernel (drivers/staging/ozwpan/ozhcd.c and related ozusbsvc1.c parsing paths) up to kernel 4.0.5. Root cause is integer signedness and length-field handling flaws in the OZWPAN stack, enabling remote attackers to cause denial of service ...

CVE-2016-2549

CVE-2016-2549 affects the Linux kernel prior to version 4.4.1, where sound/core/hrtimer.c fails to prevent recursive callback access, enabling local users to trigger a denial of service (deadlock) via a crafted ioctl. Connected advisories (Unity Linux UTSA-2026-000840/000...) confirm this issue i...

CVE-2016-8660

CVE-2016-8660 affects the Linux kernel XFS subsystem up to version 4.8.2. A local attacker can trigger a denial of service (fdatasync failure and system hang) by using the vfs syscall group in the Trinity program, due to a page lock order bug in the XFS seek hole/data implementation. The root cau...

CVE-2017-16648

CVE-2017-16648 affects the Linux kernel, specifically the dvb_frontend_free function in drivers/media/dvb-core/dvb_frontend.c, up to kernel 4.13.11. The issue is a use-after-free in the DVB frontend management path that can be triggered by a crafted USB device, enabling local users to cause a den...

CVE-2021-46997

CVE-2021-46997 is rejected/not used; not an active vulnerability entry.

CVE-2021-47131

CVE-2021-47131 affects the Linux kernel net/tls offload path. The vulnerability occurs when a netdev with TLS offload goes down and then up while a TLS context is still referenced, risking use-after-free after a data flow resumes. Fixes keep the TLS context alive until normal destruction and add ...

CVE-2021-47138

In CVE-2021-47138, the Linux kernel cxgb4 driver is vulnerable because hardware registers for the server TID base can hold invalid values when the adapter is in a bad state (e.g., AER fatal error). Reading these values during filter clearing could cause out-of-bounds memory access. The fix uses t...

CVE-2021-47402

CVE-2021-47402 affects the Linux kernel’s net: sched: flower (cls_flower). The issue arises from a use-after-free when filters are deleted concurrently due to missing RCU protection during fl_walk() iteration after a patch refactor. The provided advisories state that fl_walk() must obtain the RCU...

CVE-2022-20106

The CVE-2022-20106 entry concerns the MM service, with a heap-based buffer overflow causing an out-of-bounds write that could enable local privilege escalation to SYSTEM. Exploit details or in-the-wild activity are not provided in the documents. No user interaction is required. Remediation refere...

CVE-2022-40476

CVE-2022-40476: A NULL pointer dereference in fs/io_uring.c of the Linux kernel prior to 5.15.62 allows a local user to crash the system or potentially cause a denial of service. Affected software: Linux kernel (pre-5.15.62). Root cause: NULL pointer dereference in io_uring handling. Impact: loca...

CVE-2022-47938

Technical details are not publicly provided in the supplied documents. CVE-2022-47938 concerns ksmbd in the Linux kernel 5.15–5.19 before 5.19.2, with an out-of-bounds read during SMB2_TREE_CONNECT; monitor for updates.

CVE-2022-48664

CVE-2022-48664 concerns the Linux kernel, specifically the btrfs filesystem. The issue caused hangs during unmount when a space reclaim worker is stopped, usually observed as a long-blocked umount task in tests (e.g., generic/562). The described sequence shows the cleaner kthread starting a trans...

CVE-2022-49035

CVE-2022-49035 in the Linux kernel affects media: s5p_cec by not consistently limiting msg.len to CEC_MAX_MSG_SIZE. Root cause is the len check not enforced in all code paths, potentially enabling a corner-case that could impact availability (per CVSS: LOCAL, HIGH impact to availability; I/I/C = ...

CVE-2022-49188

CVE-2022-49188 affects the Linux kernel remoteproc: qcom_q6v5_mss path, where leaks can occur in q6v5_alloc_memory_region due to improper device_node handling. The root cause is that the device_node pointer returned by of_parse_phandle() or of_get_child_by_name() is not always balanced with of_no...

CVE-2022-49930

CVE-2022-49930 affects the Linux kernel in the RDMA/hns path (free_mr_init) where a race can cause a NULL pointer dereference when a lock is grabbed concurrently without proper initialization. The vulnerability leads to an in-kernel NULL dereference (call trace beginning at __mutex_lock.constprop...

CVE-2022-50213

CVE-2022-50213 is a Linux kernel nf_tables/use-after-free vulnerability. When looking up NFT sets by ID within a batch, a set from a different table could be returned, and after the table was freed, a dangling reference could be exploited. The issue is in the cross-table handling of SET_ID and is...

CVE-2023-2019

CVE-2023-2019 : A flaw in the Linux kernel netdevsim device driver’s event scheduling due to improper management of a reference count. This can enable a local attacker to cause a denial-of-service on the system. The description and references in the connected docs point to a kernel-level issue; n...

CVE-2023-4611

CVE-2023-4611 is a use-after-free in the Linux kernel memory subsystem (mm/mempolicy.c) caused by a race between mbind() and VMA-locked page fault. The vulnerability could allow a local attacker to crash the system or leak kernel information. Connected sources confirm the affected component and t...

CVE-2023-52567

CVE-2023-52567 : In the Linux kernel serial driver (8250_port), if a leaf driver uses IRQ polling (irq=0) and the IIR indicates an interrupt, the IRQ data can be NULL, potentially leading to a NULL pointer dereference. The published fix adds a check to ensure IRQ data is valid before wake-up hand...

CVE-2023-52763

The CVE-2023-52763 issue concerns the Linux kernel i3c master driver (i3c: master: mipi-i3c-hci). The root cause is a use-after-init sequence: i3c_master_bus_init may attach I2C devices before the I3C bus is initialized, causing the DAT_data alloc_entry to be used before init, and, if init fails,...

CVE-2023-52994

Summary (CVE-2023-52994): In the Linux kernel, suspending a system under Xen PV could dereference NULL due to a missed code path in acpi_get_wakeup_address, caused by the commit that skipped realmode init for Xen PV guests. The fix adds an optional ACPI callback to skip setting the wakeup address...

CVE-2023-53107

CVE-2023-53107 concerns the Linux kernel veth/XDP path, specifically a use-after-free in XDP_REDIRECT triggered via AF_XDP. The root cause was a bug in veth_xdp_rcv_skb introduced by commit 718a18a0c8a6 that could call kmalloc to expand headroom when headroom

CVE-2024-26807

CVE-2024-26807 affects the Linux kernel via the cadence-quadspi driver path: runtime_suspend() and runtime_resume() incorrectly use dev_get_drvdata to retrieve a struct that is not a valid spi_controller pointer, causing memory corruption during PM runtime if probe enables PM runtime. Local impac...

CVE-2024-35815

CVE-2024-35815: In the Linux kernel, a vulnerability in fs/aio arose because the first kiocb_set_cancel_fn() argument could point to a struct kiocb not embedded in struct aio_kiocb, causing req->ki_ctx to be read around the IOCB_AIO_RW test depending on compiler behavior. The fix guarantees th...

CVE-2024-35980

CVE-2024-35980 affects the Linux kernel (arm64/KVM) where TLBI RANGE operand sorting could produce an incorrect address range during live migration, causing destination VMs to crash as some dirty pages were not flushed. The issue arises from how kvm_tlb_flush_vmid_range() interacts with __kvm_tlb...

CVE-2024-35992

CVE-2024-35992 : Linux kernel vulnerability in marvell a3700-comphy driver exposes an out-of-bounds read of gbe_phy_init_fix[fix_idx].addr; after fix_idx reaches ARRAY_SIZE(gbe_phy_init_fix), an iteration may read beyond, unless gbe_phy_init[addr] is used when all elements of gbe_phy_init_fix are...

CVE-2024-36009

CVE-2024-36009 affects the Linux kernel ax25 subsystem where the netdev refcount issue was caused by using the wrong tracker during device detachment. The technical details show that a dev_tracker was attached to ax25_cb in ax25_bind(), and upon detachment the tracker for ax25_cb must be dealloca...

CVE-2024-36019

CVE-2024-36019 has concrete Linux kernel details in the connected document set: the issue is in the Linux kernel regmap maple driver, where cache corruption occurred due to indexing regcache_maple_entry[] by the register address instead of the required offset when preserving the upper end of a ca...