CVE-2024-35971

CVE-2024-35971 concerns the ks8851 driver in the Linux kernel. The vulnerability arises when ks8851_irq() locks a spinlock and then calls netif_rx(), which can trigger do_softirq() while the lock is held, potentially causing a hang as the chain leads to a re-entrant lock attempt in ks8851_start_x...

CVE-2024-56628

CVE-2024-56628 affects the Linux kernel on LoongArch where an architecture-specific huge_pte_clear() implementation caused invalid huge_pte entries to be mishandled during PMD/PGD range freeing. The description notes a bug path leading to a bad page state in uffd-unit-tests and a subsequent kerne...

CVE-2024-58070

CVE-2024-58070 : In the Linux kernel, the bpf_local_storage path could invoke sleep-unsafe allocations in PREEMPT_RT contexts. The root cause is that kmalloc(GFP_ATOMIC) remains unsafe in non-preemptible contexts under PREEMPT_RT, so the patch enforces using bpf_mem_alloc in bpf_local_storage whe...

CVE-2025-21754

The CVE-2025-21754 affects Linux kernel btrfs behavior. When a direct IO write triggers a transaction abort, ordered extents are marked with BTRFS_ORDERED_IOERR, and if an ordered extent still has bytes remaining, btrfs_split_ordered_extent() asserts on flags. The documented root cause is an asse...

CVE-2025-21857

CVE-2025-21857 affects the Linux kernel net/sched code (cls_api). The root cause is error handling in tcf_exts_miss_cookie_base_alloc() calling xa_alloc_cyclic() that can return 1 (wraps successfully), which is treated as an error by tcf_exts_init_ex() and causes ext­s to be NULL. fl_change() the...

CVE-2025-22117

CVE-2025-22117 affects the Linux kernel ice driver (ice_vc_fdir_parse_raw in ice_virtchnl_fdir.c). The vulnerability arises from using an untrusted value of pkt_len, fixed by verifying pkt_len does not exceed VIRTCHNL_MAX_SIZE_RAW_PACKET in ice_vc_fdir_parse_raw(). Connected advisories (Debian, O...

CVE-2025-23143

CVE-2025-23143 is a Linux kernel issue where unloading a module (e.g., CIFS/NFS) can race with a TCP socket still alive, leading to a NULL pointer dereference in lockdep when hlock_class() is called after the module is gone. The root cause is that CIFS assigns a different lock class to the socket...

CVE-2025-23149

CVE-2025-23149 refers to a Linux kernel vulnerability in TPM handling. The issue is triggered when TPM_CHIP_FLAG_SUSPENDED is checked after tpm_find_get_ops(), which can spuriously invoke tpm_chip_start() while the TPM chip is suspended. The provided logs show a sequence leading to a potential tr...

CVE-2025-37755

CVE-2025-37755 is described in the Azure Linux 3.0 security advisory as a Linux kernel vulnerability in net: libwx related to page_pool_dev_alloc_pages returning NULL. The WARN_ON(!page) path could continue to dereference a NULL pointer, causing a crash. The Azure Nessus note confirms the affecte...

CVE-2025-37775

CVE-2025-37775 affects the Linux kernel in the ksmbd component. The issue centers on a warning in __kernel_write_iter that could relate to directory write attempts; the patch stabilizes behavior by not allowing writes to directories, as described in the initial advisory. The vulnerability is addr...

CVE-2025-37793

CVE-2025-37793 affects the Linux kernel ASoC: Intel avs driver. The vulnerability arises when avs_component_probe() dereferences a NULL from devm_kasprintf() if memory allocation fails, leading to a NULL pointer dereference. A fix was implemented in the kernel to check for NULL from devm_kasprint...

CVE-2025-37892

In CVE-2025-37892, the Linux kernel mtd/inftlcore had a missing error check for inftl_read_oob() in INFTL_findwriteunit(); the return value must be validated, with reference logic located in INFTL_deleteblock() to set the status to SECTOR_IGNORE and break the loop when inftl_read_oob() fails. Con...

CVE-2025-37967

CVE-2025-37967 affects the Linux kernel USB Type-C UCSI driver (displayport) and fixes a deadlock when handling DP Alt Mode. The patch adds ucsi_con_mutex_lock and ucsi_con_mutex_unlock so the connector mutex is only acquired when a connection exists and the partner pointer is valid, preventing a...

CVE-2025-38087

The CVE-2025-38087 entry refers to a Linux kernel vulnerability in net/sched: taprio_dev_notifier, where a race with advance_sched could cause a use-after-free because taprio_dev_notifier() was not protected by an RCU read-side critical section. The issue is resolved by adding an rcu_read_lock() ...

CVE-2026-53176

CVE-2026-53176 affects the Linux kernel iSER (IB/isert) login handling in ib_isert.c. A remote iSER initiator could send a login PDU shorter than ISER_HEADERS_LEN (76), causing an integer underflow in isert_login_recv_done() when computing login_req_len, leading to a negative length used in a mem...

CVE-2026-53309

CVE-2026-53309 relates to the Linux kernel OCFS2 DLM component. A bug in the dlm_match_regions() region comparison used a <= bound, allowing reads beyond the valid range of qr_regions. The fix modifies the loop condition to use

CVE-2008-1669

Summary: CVE-2008-1669 affects the Linux kernel and arises from inadequate protection for fcntl in 2.6.x kernels prior to 2.6.25.2. The issue enables local users to (1) execute code in parallel and (2) trigger a race that can give re-ordered access to the descriptor table. Evidence in connected a...

CVE-2010-4157

CVE-2010-4157 involves an integer overflow in the Linux kernel’s GDTH SCSI driver (gdth_ioctl_alloc/ioc_general) on 64-bit platforms. A 32/64-bit mismatch when handling a large argument in an ioctl can cause memory corruption, enabling a local user to trigger a denial of service (and potentially ...

CVE-2010-4242

CVE-2010-4242 affects the Linux kernel 2.6.36 (and possibly other versions). The vulnerability is in the HCI UART driver, specifically the hci_uart_tty_open function in drivers/bluetooth/hci_ldisc.c, which does not verify if the tty has a write operation. This can allow a local user to cause a de...

CVE-2011-3353

CVE-2011-3353 : In the Linux kernel, a buffer/length handling issue in fuse_notify_inval_entry (fs/fuse/dev.c) before 3.1 can allow a local attacker mounting a FUSE filesystem to trigger a BUG_ON and system crash, i.e., local denial of service. Public advisories (e.g., OpenSUSE, Red Hat/Oracle/Li...

CVE-2012-3511

The CVE-2012-3511 entry maps to the Linux kernel issue in mm/madvise.c: madvise_remove contains race conditions that can be exploited locally to trigger use-after-free and kernel crash, resulting in denial of service via munmap or close. Affected lineage includes kernels before 3.4.5; patches add...

CVE-2013-7281

CVE-2013-7281 affects the Linux kernel’s dgram_recvmsg in net/ieee802154/dgram.c and allows local users to leak kernel stack memory by updating a length value without initializing an associated data structure. The issue is fixed in kernel 3.12.4 (patch referenced in changelog), with exposure via ...

CVE-2014-5207

CVE-2014-5207 affects the Linux kernel up to version 3.16.1. The flaw occurs in fs/namespace.c where clearing MNT_NODEV, MNT_NOSUID, MNT_NOEXEC and changing MNT_ATIME_MASK during a remount of a bind mount is not properly restricted, allowing local users to gain privileges, interfere with backups/...

CVE-2015-4001

CVE-2015-4001 family affects the OZWPAN driver in the Linux kernel (drivers/staging/ozwpan/ozhcd.c and related ozusbsvc1.c parsing paths) up to kernel 4.0.5. Root cause is integer signedness and length-field handling flaws in the OZWPAN stack, enabling remote attackers to cause denial of service ...

CVE-2015-8944

CVE-2015-8944 concerns the Linux kernel up to version 4.7 (as used in Android on Nexus 6/7 devices before 2016-08-05). The ioresources_init function in kernel/resource.c uses weak permissions for /proc/iomem, allowing local users to read this file and obtain sensitive information. The description...

CVE-2016-7915

CVE-2016-7915 affects the Linux kernel, where the hid_input_field function in drivers/hid/hid-core.c (pre-4.6) can be triggered by a physically proximate USB device (e.g., Logitech DJ receiver) to perform an out-of-bounds read, leaking kernel memory or causing a denial of service. The issue arise...

CVE-2017-2634

CVE-2017-2634 affects the Linux kernel DCCP implementation prior to 2.6.22.17, where the IPv4-only inet_sk_rebuild_header() function was used for both IPv4 and IPv6 DCCP connections. This can result in memory corruptions and allows a remote attacker to crash the system. Connected advisories confi...

CVE-2019-20422

The CVE-2019-20422 issue affects the Linux kernel prior to 5.3.4, where fib6_rule_lookup in net/ipv6/ip6_fib.c mishandles the RT6_LOOKUP_F_DST_NOREF flag in a reference-count decision, potentially causing a crash identified by syzkaller (CID-7b09c2d052db). The vulnerability arises from incorrect ...

CVE-2021-47119

CVE-2021-47119 (Linux kernel/ext4) involves a memory leak in ext4_fill_super where buffer head references (and the page referenced by b_data) are not freed by kill_bdev. The issue arises when block sizes differ: sb_set_blocksize() kills current buffers/page cache via kill_bdev and then rereads th...

CVE-2021-47162

CVE-2021-47162 summary (Linux kernel TIPC): The issue in tipc_bufAppend() could cause use-after-free crashes when a frag skb is appended to a frag_list that is shared by multiple skbs. The fix linearizes the head skb (skb_linearize) before skb_unshare() to ensure the appended fragment is only see...

CVE-2022-48628

The CVE-2022-48628 entry concerns a Linux kernel issue in ceph: drop messages from MDS when unmounting. The description in the primary doc states that during unmount, dirty buffers are flushed and after the last OSD request finishes, the last i_count reference is released and dirty caps/snaps are...

CVE-2022-48982

CVE-2022-48982 affects the Linux kernel Bluetooth subsystem, specifically CSR fake controllers. The issue arises when a CSR 5.0 clone causes the suspend notifier to be registered twice, which can lead to a kernel panic during Bluetooth device probing (btusb/hci stack). The connected advisories an...

CVE-2022-49134

Technical details about CVE-2022-49134 are not publicly provided in the supplied documents; no affected products/versions/fixes are specified here. Monitor for updates.

CVE-2022-49155

Summary (CVE-2022-49155): The Linux kernel’s scsi/qla2xxx path (qla2xxx_create_qpair) was patched to suppress a kernel complaint arising from using smp_processor_id() in preemptible code (as seen in systemd-udevd). The connected advisories confirm the issue is addressed in the kernel and referenc...

CVE-2022-49350

CVE-2022-49350 affects the Linux kernel in the net/mdio area, where the symbol mdio_bus_init is annotated with init and exported. The combination of EXPORT_SYMBOL with init places code in .init.text, which may be freed after init and lead to a kernel panic if accessed by modules. The public advis...

CVE-2022-49441

CVE-2022-49441 relates to a Linux kernel deadlock in tty handling. The root cause is a potential deadlock when kmalloc() path could trigger a printk() while holding tty_port->lock, enabling a cycle with console ownership locks. The described failing scenario involves multiple CPUs acquiring po...

CVE-2022-49795

The CVE-2022-49795 entry pertains to the Linux kernel: in rethook_alloc(), the local variable rh could be leaked if handler is NULL, causing a potential memory leak. The issue is described as a memleak in rethook_alloc(), which is resolved by the fix. Connected documents (e.g., SUSE OSV entries a...

CVE-2022-49921

CVE-2022-49921 has concrete details in connected sources: the Linux kernel vulnerability is a use-after-free in net_sched (red_enqueue) where skb must not be reused after qdisc_enqueue() is called. The tied OpenVAS/NASL entries corroborate the fix as part of the kernel scheduling code, linking to...

CVE-2023-52564

CVE-2023-52564 is a Linux kernel issue related to the GSM tty driver. The advisory states that reverting the patch “tty: n_gsm: fix UAF in gsm_cleanup_mux” did not solve the original problem. The root cause described is that gsm_cleanup_mux() could call gsm_dlci_release() (via dlci_put()/tty_port...

CVE-2023-52618

In the Linux kernel, the following vulnerability has been resolved: block/rnbd-srv: Check for unlikely string overflow Since "dev_search_path" can technically be as large as PATH_MAX,there was a risk of truncation when copying it and a second stringinto "full_path" since it was also PATH_MAX size...

CVE-2023-52631

The Linux kernel contains a NULL dereference vulnerability in the fs/ntfs3 component. The issue occurs when ntfs_load_attr_list() is called; specifically, on 32-bit systems , the calculation of the "size" variable (from le32_to_cpu(attr->res.data_size)) can overflow when adding 1023, resulting...

CVE-2023-52854

CVE-2023-52854 affects the Linux kernel's padata subsystem. In high-load arm64 scenarios, a race in refcount handling can cause a Use-After-Free when pd is freed during padata_serial_worker execution, leading to a potential crash or memory corruption. The documented root cause is improper refcoun...

CVE-2023-52994

Summary (CVE-2023-52994): In the Linux kernel, suspending a system under Xen PV could dereference NULL due to a missed code path in acpi_get_wakeup_address, caused by the commit that skipped realmode init for Xen PV guests. The fix adds an optional ACPI callback to skip setting the wakeup address...

CVE-2023-53060

CVE-2023-53060 concerns the igb driver in the Linux kernel. The description shows a data-race concern was introduced by a patch that added a lock via rtnl_lock to avoid a race between igb_remove/igb_ndo_get_vf_config and igb_disable_sriov paths, but this lock created a deadlock scenario during de...

CVE-2024-26677

CVE-2024-26677 : In the Linux kernel’s rxrpc implementation, the vulnerability stems from how delayed ACKs were constructed with a reference serial number, making them unsuitable as an RTT reference. The issue has been resolved in the kernel by fixing the construction of delayed ACKs to avoid set...

CVE-2024-26795

CVE-2024-26795 concerns a Linux kernel riscv issue where the Sparse-Memory/vmemmap was out-of-bounds due to misoffsetting of vmemmap. The fix maps the first page of vmemmap to the first page of physical memory to ensure vmemmap bounds are respected during pfn_to_page() and page_to_pfn() operation...

CVE-2024-35797

CVE-2024-35797 pertains to the Linux kernel, specifically the mm: cachestat path involving two shmem-related bugs that could occur when cachestat runs concurrently with swapping and invalidation. Root causes described in the sources: (1) a poisoned swap entry in the shmem inode’s xarray could lea...

CVE-2024-35815

CVE-2024-35815: In the Linux kernel, a vulnerability in fs/aio arose because the first kiocb_set_cancel_fn() argument could point to a struct kiocb not embedded in struct aio_kiocb, causing req->ki_ctx to be read around the IOCB_AIO_RW test depending on compiler behavior. The fix guarantees th...

CVE-2024-35885

Mode CThe CVE affects the mlxbf_gige Linux kernel driver. The issue is a NULL pointer dereference during shutdown in mlxbf_gige_handle_tx_complete, leading to kernel Oops and a fatal interrupt (kernel panic). It can leave NAPI enabled and the network interface in an inconsistent state if stop() i...

CVE-2024-36029

CVE-2024-36029 affects the Linux kernel’s MMC subsystem, specifically the mmc: sdhci-msm driver. The vulnerability arises because the sdhci-msm driver does not set the host->runtime_suspended flag, which protects access to the LED device registered by the generic sdhci code. As a result, acces...