CVE-2024-35885

Mode CThe CVE affects the mlxbf_gige Linux kernel driver. The issue is a NULL pointer dereference during shutdown in mlxbf_gige_handle_tx_complete, leading to kernel Oops and a fatal interrupt (kernel panic). It can leave NAPI enabled and the network interface in an inconsistent state if stop() i...

CVE-2024-38562

CVE-2024-38562 affects the Linux kernel wifi nl80211 implementation. The vulnerability arises from improper address calculations after memory allocation for the channels array: before using request->channels[], request->n_channels must be set, and address computations for memory after the c...

CVE-2024-38591

CVE-2024-38591 affects the Linux kernel RDMA/hns driver. The issue is a deadlock in SRQ handling during asynchronous events: xa_lock for the SRQ table may be required in AEQ, and the patch uses xa_store_irq() / xa_erase_irq() to avoid deadlock. Documentation confirms the vulnerability is resolved...

CVE-2024-39490

The CVE-2024-39490 entry concerns a memory-leak in the Linux kernel SRv6 path. The issue was in ipv6Seg6_input_core handling when skb_cow_head() fails: seg6_input_core() caught the error but did not release the associated sk_buff, leaking memory. This vulnerability was introduced by earlier commi...

CVE-2024-40909

CVE-2024-40909 is a Linux kernel vulnerability resolved in the bpf subsystem. After commit 1a80dbcb2dba, a race could cause a use-after-free when bpf_link is freed by link->ops->dealloc_deferred but the code still tests and uses link->ops->dealloc afterward. The fix ensures only one o...

CVE-2024-41034

CVE-2024-41034 : In the Linux kernel, the nilfs2 filesystem may fail during rename of a broken directory due to __block_write_begin_int() potentially triggering a BUG_ON when the parent reference entry ("..") is located beyond a folio/page boundary. The root cause is insufficient validation in ni...

CVE-2024-45020

Concrete details found: CVE-2024-45020 affects the Linux kernel BPF verifier, specifically a crash in stacksafe() caused by out-of-bounds memory access when iterating old->allocated_stack. The fix adds a check i >= cur->allocated_stack to fail stacksafe() when the condition would access ...

CVE-2024-46829

The CVE-2024-46829 entry affects the Linux kernel and concerns a deadlock condition in rtmutex handling. Root cause: rt_mutex_handle_deadlock() is invoked with rt_mutex::wait_lock still held; in the deadlock path this could lead to an endless scheduling loop while the lock remains held and trigge...

CVE-2024-46869

CVE-2024-46869 relates to the Linux kernel Bluetooth driver, specifically the btintel_pcie path. The issue was caused by not allocating memory for the driver-private data structure (struct btintel_data), leaving internal data storage unallocated. The connected Astra Linux security bulletin restat...

CVE-2024-47702

CVE-2024-47702 (Linux kernel) : The issue arises in BPF verification for sign-extension of packet data/data_end/data_meta UAPI fields, where sign-extending a 32-bit skb->data load can yield an invalid 64-bit address after truncation to 32 bits. This can cause kernel verification to fail or run...

CVE-2024-47720

CVE-2024-47720 in the Linux kernel relates to the AMD display path (drm/amd/display) where dcn30_set_output_transfer_func dereferenced set_output_gamma without a null check. The patch adds a nullity check for set_output_gamma before calling it and logs an error if it is NULL, preventing a potenti...

CVE-2024-50021

Technical details for CVE-2024-50021 are not publicly disclosed in the provided Connected documents. Monitor for updates from vendor/security advisories.

CVE-2024-53086

Technical details about CVE-2024-53086 are not publicly provided in the supplied documents. Please monitor for updates from kernel commits and vendor advisories to obtain affected products, vulnerable components, and remediation.

CVE-2024-56537

Technical details for CVE-2024-56537 are not publicly available in the provided documents. No vendor/product specifics or remediation are given here. Monitor for official advisories and patch notes for affected kernel components.

CVE-2024-56617

CVE-2024-56617 affects the Linux kernel cacheinfo handling during CPU hotplug. The root cause is potential NULL dereference in last_level_cache_is_valid when cacheinfo memory was not allocated (x86 does not use early build); a patch sequence allocates cacheinfo memory during hotplug when not done...

CVE-2024-56687

The CVE-2024-56687 issue affects the Linux kernel USB MUSB gadget path, where a request’s complete callback could be invoked from usb_ep_queue(), risking a hardware lockup and potential deadlock in the RX path. Root cause involves complex interaction between RXPKTRDY handling, IRQs, and the callb...

CVE-2024-56702

The CVE-2024-56702 issue is a Linux kernel fix for BPF raw tracepoints. It explains that raw_tp arguments were previously treated as non-NULL, risking NULL dereferences when NULL values occur. The fix marks raw_tp arguments as PTR_MAYBE_NULL and adjusts dereferences, arithmetic, and allowed passe...

CVE-2024-58057

CVE-2024-58057 is described in connected advisories as a Linux kernel issue where the idpf driver converts workqueues to unbound (WQ_UNBOUND). The root cause is that unbound workqueues allow worker threads to run on any CPU within the same node when no CPU is specified, which can cause large comp...

CVE-2025-21732

CVE-2025-21732 pertains to the Linux kernel RDMA mlx5 path. It describes a race in the ODP MR handling where, during __mlx5_ib_dereg_mr(), a concurrent mlx5_ib_invalidate_range() can invalidate a freed lkey, triggering a CQE error and potentially placing the UMR QP in an error state. The disclose...

CVE-2025-21754

The CVE-2025-21754 affects Linux kernel btrfs behavior. When a direct IO write triggers a transaction abort, ordered extents are marked with BTRFS_ORDERED_IOERR, and if an ordered extent still has bytes remaining, btrfs_split_ordered_extent() asserts on flags. The documented root cause is an asse...

CVE-2025-21856

The CVE-2025-21856 issue affects Linux kernel on s390/ISM where devices must have a release function. The kernel previously freed a struct device after device_add() without waiting for other references (e.g., sysfs), allowing a use-after-free if a release function was not set. Root cause: missing...

CVE-2025-22030

CVE-2025-22030 involves a deadlock in the Linux kernel zswap path. The root cause: zswap_cpu_comp_dead() can call crypto_free_acomp() while holding the per-CPU acomp_ctx mutex, while crypto_free_acomp() may attempt to acquire scomp_lock via crypto_exit_scomp_ops_async(), and crypto_alloc_acomp_no...

CVE-2025-22068

The CVE-2025-22068 issue affects the Linux kernel ublk (userspace block driver). Root cause: ubq->canceling was not reliably observed when the queue froze, which could lead to improper dispatch decisions in uring_cmd and io_uring_cmd_complete_in_task(). The patch makes ubq->canceling be set...

CVE-2025-23129

CVE-2025-23129: In the Linux kernel, the ath11k PCI driver (ath11k_pci) could log a warning when error paths freed a shared IRQ without clearing the IRQ affinity hint. The root cause was setting the IRQ affinity hint after irq vector allocation in ath11k_pci_alloc_msi(), which caused free_irq in ...

CVE-2025-23137

CVE-2025-23137: A NULL pointer dereference in Linux kernel cpufreq/amd-pstate during amd_pstate_update has been fixed by adding a NULL check for policy before dereferencing. This resolves a local-privilege scenario with a MEDIUM base score (CVSS v3.1: AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). The con...

CVE-2025-37744

CVE-2025-37744 affects the Linux kernel’s ath12k PCI wireless driver, where a memory allocated during ath12k_pci_probe() could leak if ATH12K_FLAG_QMI_FAIL is set and ath12k_fw_unmap() is not invoked in ath12k_pci_remove(). The issue is mitigated by a fixed sequence in the kernel fix, documented ...

CVE-2025-37777

CVE-2025-37777: In the Linux kernel ksmbd path, a use-after-free could occur in __smb2_lease_break_noti() when the connection is disconnected, because ksmbd_conn_write may touch freed structures if conn->ksmbd_transport is already freed. The fix moves the tcp_transport free to ksmbd_conn_free,...

CVE-2025-37952

CVE-2025-37952 describes a use-after-free in ksmbd within the Linux kernel. A thread destroying a file via __ksmbd_close_fd can race with another thread holding a reference to the same file, because the existing fp->refcount checks do not prevent the issue. The fix adds ft->lock around the ...

CVE-2025-37954

CVE-2025-37954 affects the Linux kernel SMB client path, specifically a race in find_or_create_cached_dir/open_cached_dir. A valid cfid returned during find_or_create_cached_dir could race with a lease-break, causing open_cached_dir to treat the cfid as invalid and potentially leak a dentry refer...

CVE-2025-37980

CVE-2025-37980: In the Linux kernel block subsystem, a resource leak occurs in blk_register_queue() when a queue registration fails after blk_mq_sysfs_register() succeeds. The error-path path lacks cleanup of blk_mq_sysfs resources, leading to memory leaks. The advisory documents that the fix is ...

CVE-2025-38349

The CVE-2025-38349 entry concerns a Linux kernel eventpoll use-after-free risk due to dropping the epoll refcount while the ep mutex is still held. Description and related details explain that incrementing/decrementing the ep refcount in the wrong order combined with unlock timing can allow a con...

CVE-2026-43074

CVE-2026-43074 affects the Linux kernel eventpoll code. The vulnerability arises from ep_free() freeing the eventpoll structure while still in use by another thread, creating a use-after-free (UAF). The fix defers kfree() of the epi->ep struct to an RCU grace period to prevent UAF; multiple so...

CVE-2008-4307

CVE-2008-4307 is a Linux kernel local-denial-of-service issue caused by a race in do_setlk (fs/nfs/file.c) where improper handling of a race between fcntl and close in the EINTR path can crash the kernel and leave a stray FL_POSIX lock. Affected product: Linux kernel versions before 2.6.26. The v...

CVE-2008-5029

CVE-2008-5029 affects the Linux kernel 2.6.27.4, 2.6.26 and earlier via the __scm_destroy function in net/core/scm.c, which can cause indirect recursive calls when closing sockets after an SCM_RIGHTS message. This local DoS (panic) condition results from the kernel’s handling of UNIX domain socke...

CVE-2009-2695

CVE-2009-2695 affects the Linux kernel before 2.6.31-rc7, where mmap operations targeting page zero and other low memory addresses are not properly prevented. This enables local privilege escalation via NULL pointer dereference vulnerabilities, linked to (1) SELinux’s allow_unconfined_mmap_low se...

CVE-2009-4307

The CVE-2009-4307 issue affects the Linux kernel ext4 subsystem: the ext4_fill_flex_info function in fs/ext4/super.c allows a remote attacker to trigger a divide-by-zero and panic when a malformed ext4 super block has a large FLEX_BG group size (s_log_groups_per_flex). Impact is denial of service...

CVE-2010-0307

CVE-2010-0307 affects the Linux kernel (x86_64) prior to 2.6.32.8 where load_elf_binary in fs/binfmt_elf.c may call SET_PERSONALITY before confirming the ELF interpreter exists, enabling a local DoS via a 32-bit process launching a 64-bit one and triggering a segmentation fault (flush_old_exec re...

CVE-2010-3084

CVE-2010-3084 refers to a buffer overflow in the Linux kernel 2.6 series (niu_get_ethtool_tcam_all in drivers/net/niu.c) exploitable via the ETHTOOL_GRXCLSRLALL ethtool command. Affected: Linux kernel older than 2.6.36-rc4. Impact described as local denial of service and potential other effects (...

CVE-2010-4072

CVE-2010-4072 affects the Linux kernel: the copy_shmid_to_user function in ipc/shm.c (pre-2.6.37-rc1) does not initialize a certain structure, enabling local users to leak potentially sensitive information from kernel stack memory via the shmctl interface and the old shm interface. Affected produ...

CVE-2010-4242

CVE-2010-4242 affects the Linux kernel 2.6.36 (and possibly other versions). The vulnerability is in the HCI UART driver, specifically the hci_uart_tty_open function in drivers/bluetooth/hci_ldisc.c, which does not verify if the tty has a write operation. This can allow a local user to cause a de...

CVE-2010-4251

CVE-2010-4251 affects the Linux kernel up to version 2.6.34. The vulnerability lies in the socket backlog handling in net/core/sock.c, which allows remote attackers to cause memory exhaustion DoS by sending大量 network traffic (e.g., UDP via netperf). The issue is addressed by the 2.6.34 changelog ...

CVE-2011-1079

The CVE-2011-1079 issue affects the Linux kernel up to version 2.6.38 (before 2.6.39) in the bnep_sock_ioctl path (net/bluetooth/bnep/sock.c). A local attacker could exploit inadequate termination of a device field (missing trailing NUL) via a BNEPCONNADD command to read kernel stack memory and p...

CVE-2011-1082

CVE-2011-1082 affects the Linux kernel prior to 2.6.38. The flaw is in fs/eventpoll.c where epoll file descriptors may be placed inside other epoll data structures without proper validation of closed loops or deep chains. This can let a local user cause a denial of service (deadlock or stack memo...

CVE-2011-2496

CVE-2011-2496 affects the Linux kernel prior to 2.6.39. An integer overflow in vma_to_resize (mm/mremap.c) lets local users trigger a BUG_ON and system crash via a crafted mremap call that expands a memory mapping. Mitigation: upgrade to kernel 2.6.39 or later where the issue is fixed. The connec...

CVE-2011-5321

The vulnerability CVE-2011-5321 affects the Linux kernel up to version 3.1.0, specifically the tty_open function in drivers/tty/tty_io.c, where a driver-lookup failure can lead to a NULL pointer dereference and system crash via crafted access to /dev/pts devices. Local users can cause a denial of...

CVE-2012-2121

CVE-2012-2121 affects the KVM component of the Linux kernel prior to 3.3.4. The vulnerability stems from improper management of the relationships between memory slots and the iommu, enabling guest OS users (with administrative access inside the guest) to trigger hotplug/hotunplug operations on de...

CVE-2012-2313

The CVE-2012-2313 issue affects the Linux kernel up to version 3.3.7, where rio_ioctl in drivers/net/ethernet/dlink/dl2k.c does not restrict access to the SIOCSMIIREG ioctl. This allows local attackers to write data to an Ethernet adapter via an ioctl call. The vulnerability is rooted in insuffic...

CVE-2014-4655

CVE-2014-4655 affects the Linux kernel ALSA control path: snd_ctl_elem_add in sound/core/control.c does not correctly maintain user_ctl_count, enabling a local DoS via a large number of SNDRV_CTL_IOCTL_ELEM_REPLACE calls to /dev/snd/controlCX. Affected: Linux kernel prior to 3.15.2 (ALSA control ...

CVE-2014-5207

CVE-2014-5207 affects the Linux kernel up to version 3.16.1. The flaw occurs in fs/namespace.c where clearing MNT_NODEV, MNT_NOSUID, MNT_NOEXEC and changing MNT_ATIME_MASK during a remount of a bind mount is not properly restricted, allowing local users to gain privileges, interfere with backups/...

CVE-2014-9731

The CVE-2014-9731 entry concerns the Linux kernel’s UDF filesystem (CONFIG_UDF_FS) for versions before 3.18.2. The vulnerability arises because the UDF symlink path length validation may not accommodate space for storing a symlink target’s name plus a trailing NUL, enabling a local attacker to ob...