CVE-2026-53016

Summary of CVE-2026-53016 (Linux kernel): The vulnerability exists in the crypto CCP driver when handling AF_ALG rfc3686-ctr-aes-ccp requests. The function ccp_aes_complete() restores AES_BLOCK_SIZE bytes into the caller’s IV buffer, but RFC3686 skciphers expose an 8-byte IV, leading to a buffer ...

CVE-2025-37948

CVE-2025-37948 affects the Linux kernel arm64 and is fixed by adding a BHB mitigation in the epilogue of BPF programs (cBPF) loaded via seccomp. The vulnerability arises when a classic cBPF program manipulates the branch history to influence speculative execution. The published details indicate t...

CVE-2025-38049

CVE-2025-38049 (Linux kernel) : In x86 resctrl, allocation of the cleanest CLOSID could dereference NULL on platforms without LLC occupancy counters, causing a NULL pointer dereference when creating a new control group. The issue arises from code that searched for the CLOSID with the fewest dirty...

CVE-2025-38129

CVE-2025-38129 details a Linux kernel use-after-free in page_pool_recycle_in_ring, linked to page_pool's per-CPU recycle mechanism. The root cause is that a page may be freed while the page pool’s ring is still being recycled, resulting in a potential use-after-free when the producer_lock is not ...

CVE-2025-38678

The CVE-2025-38678 vulnerability affects the Linux kernel’s netfilter nf_tables path, where a chain/flowtable update can carry duplicate devices within the same batch. The bug could leave the hook for a duplicated device unregistering, potentially enabling a foothold in local updates. The issue i...

CVE-2004-1235

CVE-2004-1235 documents a race condition in the Linux kernel (load_elf_library and binfmt_aout paths used by uselib) affecting 2.4 (through 2.429-rc2) and 2.6 (through 2.6.10). Exploitation allows a local user to execute arbitrary code by manipulating the VMA descriptor. The initial description p...

CVE-2010-3078

The CVE-2010-3078 issue affects the Linux kernel (xfs_ioc_fsgetxattr) where a structure member is not initialized, enabling local attackers to read potentially sensitive data from kernel stack memory via an ioctl. This vulnerability is documented in MiracleLinux AXSA-2010-500:18 and is fixed in 2...

CVE-2010-3880

CVE-2010-3880 affects the Linux kernel (net/ipv4/inet_diag.c) prior to 2.6.37-rc2. The issue is improper auditing of INET_DIAG bytecode, enabling a local user to trigger a kernel infinite loop and cause a denial of service via crafted INET_DIAG_REQ_BYTECODE instructions in a netlink message conta...

CVE-2011-1078

CVE-2011-1078 affects the Linux kernel prior to 2.6.39. The vulnerable code is sco_sock_getsockopt_old in net/bluetooth/sco.c, where a structure used with the SCO_CONNINFO option is not initialized, enabling a local attacker to read potentially sensitive data from kernel stack memory. Exploitatio...

CVE-2013-2888

CVE-2013-2888 : The Linux kernel HID subsystem contains multiple array index errors in drivers/hid/hid-core.c that can be triggered by a crafted HID device providing an invalid Report ID. The vulnerability allows physically proximate attackers to execute arbitrary code or cause a denial of servic...

CVE-2013-2892

The CVE-2013-2892 issue affects the Linux kernel HID subsystem specifically the HID driver at drivers/hid/hid-pl.c. When CONFIG_HID_PANTHERLORD is enabled, a physically proximate crafted HID device can cause a heap-based out-of-bounds write, leading to a denial of service. The provided documents ...

CVE-2013-7339

The CVE-2013-7339 issue affects the Linux kernel up to version 3.12.7 (fixed in 3.12.8) where the rds_ib_laddr_check function in net/rds/ib.c allows a local attacker to trigger a NULL pointer dereference via a bind(2) call on an RDS socket on systems without RDS transports. This can cause a denia...

CVE-2014-4655

CVE-2014-4655 affects the Linux kernel ALSA control path: snd_ctl_elem_add in sound/core/control.c does not correctly maintain user_ctl_count, enabling a local DoS via a large number of SNDRV_CTL_IOCTL_ELEM_REPLACE calls to /dev/snd/controlCX. Affected: Linux kernel prior to 3.15.2 (ALSA control ...

CVE-2016-4568

CVE-2016-4568 affects the Linux kernel’s videobuf2-v4l2 implementation (drivers/media/v4l2-core/videobuf2-v4l2.c). The flaw allows a local attacker to trigger a kernel memory write (and potential other impact) via a crafted number of planes in a VIDIOC_DQBUF ioctl, leading to a denial of service ...

CVE-2016-5412

CVE-2016-5412 affects the Linux kernel on PowerPC with CONFIG_KVM_BOOK3S_64_HV enabled. A guest OS user can trigger a host denial of service (infinite loop) by issuing a H_CEDE hypercall while a transaction is suspended. The description in the supplied documents confirms the affected file and con...

CVE-2016-7917

CVE-2016-7917 affects the Linux kernel’s netfilter: the nfnetlink_rcv_batch() function in net/netfilter/nfnetlink.c does not validate the batch length against the message, enabling a local user with CAP_NET_ADMIN to read kernel memory or trigger a denial of service (infinite loop or out-of-bounds...

CVE-2017-5123

CVE-2017-5123 is a Linux kernel local privilege-escalation vulnerability in the waitid path. The waitid handler in kernel/exit.c writes to user memory by calling unsafe_put_user without performing an access_ok() check, and without wrapping user-space writes in the required user_access_begin()/use...

CVE-2018-14614

CVE-2018-14614 concerns a Linux kernel issue up to version 4.17.10 where mounting an f2fs image triggers an out-of-bounds access in __remove_dirty_segment() within fs/f2fs/segment.c. Publicly documented details identify the affected component as the kernel’s f2fs filesystem driver, with a local a...

CVE-2018-14616

CVE-2018-14616 involves a NULL pointer dereference in the Linux kernel before 4.17.10. The flaw occurs in fscrypt_do_page_crypto() (fs/crypto/crypto.c) when handling a file inside a corrupted f2fs image. Affects the Linux kernel up to 4.17.10; the issue can cause a kernel crash (availability impa...

CVE-2021-46997

CVE-2021-46997 is rejected/not used; not an active vulnerability entry.

CVE-2021-47633

CVE-2021-47633 is described in connected documents as a Linux kernel flaw in the ath5k driver where, during EEPROM parsing (ath5k_eeprom_read_pcal_info_5111), an out-of-bounds write could occur when no curve is selected in a loop, allowing idx to reach AR5K_EEPROM_N_PD_CURVES and causing pd to be...

CVE-2022-20106

The CVE-2022-20106 entry concerns the MM service, with a heap-based buffer overflow causing an out-of-bounds write that could enable local privilege escalation to SYSTEM. Exploit details or in-the-wild activity are not provided in the documents. No user interaction is required. Remediation refere...

CVE-2022-48628

The CVE-2022-48628 entry concerns a Linux kernel issue in ceph: drop messages from MDS when unmounting. The description in the primary doc states that during unmount, dirty buffers are flushed and after the last OSD request finishes, the last i_count reference is released and dirty caps/snaps are...

CVE-2022-48796

CVE-2022-48796 relates to the Linux kernel iommu path where use-after-free can occur during device probe. The issue arises when freeing dev->iommu in dev_iommu_free while a deferred_probe_work_func accesses dev->iommu->fwspec in of_iommu_configure, leading to a KASAN use-after-free. The ...

CVE-2022-48951

The CVE-2022-48951 vulnerability is in the Linux kernel ASoC path: snd_soc_put_volsw_sx() does bounds checks only for the first channel, allowing potential out-of-bounds writes to the second channel in stereo controls. This is fixed upstream by adding proper checks (e.g., kernel commits cf611d......

CVE-2022-48967

CVE-2022-48967 affects the Linux kernel NFC subsystem (NCI) and stems from a missing bounds check in nci_add_new_protocol, allowing a potential field-spanning write to target->sensf_res under Fortify and triggering an out-of-bounds write. The issue is concrete: a bounds error in net/nfc/nci/nt...

CVE-2022-49026

CVE-2022-49026 is a Linux kernel use-after-free in the e100 driver (e100_xmit_prepare) when skb mapping fails. The patch removes a harmful free, preventing UAF if the upper layer resends the skb. Reported in multiple advisories and OSS docs, the issue affects the kernel networking transmit path; ...

CVE-2022-49182

CVE-2022-49182 affects the Linux kernel net/hns3 VLAN handling. The vulnerability occurs when adding port base VLAN: removing the VF VLAN from HW and updating the VF VLAN list can lead to a use-after-free if the periodic task frees the same node. The patch adds a vlan list lock to protect the VLA...

CVE-2022-49334

The CVE-2022-49334 issue concerns the Linux kernel memory-management code for huge pages (mm/huge_memory). The root cause was that when xas_split_alloc() could not allocate required xarray nodes, it set xa_state to -ENOMEM, which xas_nomem() treated as a cue to “Please allocate more memory,” inst...

CVE-2022-49377

CVE-2022-49377 is a Linux kernel vulnerability in the block multi-queue (blk-mq) path. The root cause was a use-after-free involving ->tagset during blk_mq_run_hw_queues, when there were no queued requests and the tagset could be freed after blk_cleanup_queue. The fix disables touching tagset ...

CVE-2022-49701

CVE-2022-49701 affects the Linux kernel ibmvfc SCSI driver. The issue arises because sub-queues and event pool resources were allocated/freed for every CRQ connection event (e.g., reset, LPM) instead of only during probe/remove, creating a race window and potential list corruption when queues are...

CVE-2022-49862

CVE-2022-49862 concerns the Linux kernel TIPC subsystem. The issue arises in tipc_nl_compat_name_table_dump_header where the msg->req TLV length is not properly validated, following a prior change intended to fix uninit-value behavior when TLV_GET_DATA_LEN() can be negative. This can lead to i...

CVE-2023-52561

The Linux kernel contains a vulnerability in the sdm845-db845c component on arm64 architecture. The issue is caused by a missing reserved memory region for the framebuffer memory (the splash memory region established by the bootloader). This defect can trigger a kernel panic (specifically an arm-...

CVE-2023-52763

The CVE-2023-52763 issue concerns the Linux kernel i3c master driver (i3c: master: mipi-i3c-hci). The root cause is a use-after-init sequence: i3c_master_bus_init may attach I2C devices before the I3C bus is initialized, causing the DAT_data alloc_entry to be used before init, and, if init fails,...

CVE-2023-52774

CVE-2023-52774 : In the Linux kernel (s390/dasd), the device queue could be accessed concurrently in dasd_profile_start(), allowing the queue to change while it is being read; this could trigger a kernel panic due to invalid pointer accesses when I/O is highly parallel (aliases). The root cause i...

CVE-2023-53124

VULNERABILITY SUMMARY: CVE-2023-53124 fixes a NULL pointer dereference in the Linux kernel SCSI driver mpt3sas during transport_port_add. The port is created by sas_port_alloc_num() and rphy by sas_end_device_alloc() or sas_expander_alloc(), any of which may return NULL, and the code would access...

CVE-2024-26751

CVE-2024-26751 affects the Linux kernel on ARM (ep93xx) where the gpiod_lookup_table lacks a terminator. If gpio_find() is passed a con_id not present in the table, it may loop indefinitely and trigger an oops. The available connected documents confirm the issue and describe the fix as adding a t...

CVE-2024-35971

CVE-2024-35971 concerns the ks8851 driver in the Linux kernel. The vulnerability arises when ks8851_irq() locks a spinlock and then calls netif_rx(), which can trigger do_softirq() while the lock is held, potentially causing a hang as the chain leads to a re-entrant lock attempt in ks8851_start_x...

CVE-2024-35980

CVE-2024-35980 affects the Linux kernel (arm64/KVM) where TLBI RANGE operand sorting could produce an incorrect address range during live migration, causing destination VMs to crash as some dirty pages were not flushed. The issue arises from how kvm_tlb_flush_vmid_range() interacts with __kvm_tlb...

CVE-2024-39490

The Linux kernel contains a memory leak vulnerability in the ipv6: sr component. The seg6_input_core() function fails to release the sk_buff when the skb_cow_head() function fails to provide sufficient headroom for the link-layer header. This issue originated in commit af3b5158b89d and persisted ...

CVE-2024-40908

The CVE-2024-40908 issue affects the Linux kernel in the bpf component, specifically the rawtp test_run callback. The root cause is that the run context (task->bpf_ctx) was not properly set for the test_run callback, which SYZBOT reported could crash when a rawtp program called bpf_get_attach_...

CVE-2024-41004

CVE-2024-41004 affects the Linux kernel tracing tests for build event generation in kprobes/synth tests. The vulnerability arises when those test modules are built-in instead of modular, causing events to remain locked in the kernel and breaking kprobe self-tests, which in turn causes ftracetest ...

CVE-2024-41069

CVE-2024-41069 is a Linux kernel vulnerability in ASoC topology where references to freed memory were fixed. The changelog entries indicate root cause was pointers into topology file contents after parsing and releasing memory; the fix allocates memory via devm_kmemdup() to avoid dereferencing fr...

CVE-2024-41074

Technical details for CVE-2024-41074 are not publicly available in the provided documents. Monitor for updates from vendors and security advisories.

CVE-2024-42076

The CVE-2024-42076 entry relates to the Linux kernel net/can/j1939 path, where j1939_send_one() allocated a full frame but did not initialize unused data, enabling a kernel-infoleak via raw_recvmsg() paths observed by syzbot. The root cause is uninitialized memory in the frame allocation (Bytes 1...

CVE-2024-45020

Concrete details found: CVE-2024-45020 affects the Linux kernel BPF verifier, specifically a crash in stacksafe() caused by out-of-bounds memory access when iterating old->allocated_stack. The fix adds a check i >= cur->allocated_stack to fail stacksafe() when the condition would access ...

CVE-2024-46720

CVE-2024-46720 affects the Linux kernel; the issue is in the DRM AMDGPU path where a dereference after a null pointer check was fixed. The description from the initial document notes “drm/amdgpu: fix dereference after null check” and “check the pointer hive before use.” The connected Azure Linux ...

CVE-2024-47734

CVE-2024-47734: In the Linux kernel, the bonding subsystem fixed unnecessary warnings/logs from bond_xdp_get_xmit_slave(). The patch removes a WARN_ON_ONCE() and adds rate limiting to netdev_err() to reduce log noise when XDP is used on bonded interfaces (e.g., with bond1 xdpdrv and bond0/slave v...

CVE-2024-47751

CVE-2024-47751 affects the Linux kernel PCI Kirin driver, where kirin_pcie_parse_port() could access beyond pcie->gpio_id_reset/MAX_PCI_SLOTS due to num_slots handling. The fix changes the condition to pcie->num_slots + 1 >= MAX_PCI_SLOTS and moves the increment of num_slots below the ch...

CVE-2024-49853

CVE-2024-49853 affects the Linux kernel firmware/arm_scmi path (OPTEE transport). The issue is a double-free in the OPTEE transport where channel descriptors can be freed twice when unloading the stack, due to channels being shared between protocols. This can lead to memory corruption or potentia...