14999 matches found
CVE-2011-1090
CVE-2011-1090 affects the Linux kernel’s NFSv4 ACL handling: the function __nfs4_proc_set_acl in fs/nfs/nfs4proc.c allocates memory with kmalloc but does not always free it, enabling a local attacker to trigger a denial of service (panic) by crafting an ACL set operation. The vulnerability is doc...
CVE-2011-2498
CVE-2011-2498 affects the Linux kernel: versions prior to 2.6.39 allow local unprivileged users to trigger creation of PTE pages, causing memory consumption and a denial of service. The issue is rooted in how PTE pages are accounted for during OOM scoring. Public disclosures reference Ubuntu, SUS...
CVE-2011-5321
The vulnerability CVE-2011-5321 affects the Linux kernel up to version 3.1.0, specifically the tty_open function in drivers/tty/tty_io.c, where a driver-lookup failure can lead to a NULL pointer dereference and system crash via crafted access to /dev/pts devices. Local users can cause a denial of...
CVE-2012-1097
CVE-2012-1097 affects the Linux kernel before 3.2.10, where the regset (register set) path mishandles absence of .get/.set methods. This can allow a local attacker to trigger a NULL pointer dereference via PTRACE_GETREGSET or PTRACE_SETREGSET, possibly causing denial of service or other impact. R...
CVE-2012-6548
CVE-2012-6548 affects the Linux kernel: the udf_encode_fh function in fs/udf/namei.c does not initialize a structure member in kernels before 3.6, enabling a local user to read sensitive information from kernel heap memory via a crafted application. Several connected advisories (e.g., Red Hat RHS...
CVE-2013-2888
CVE-2013-2888 : The Linux kernel HID subsystem contains multiple array index errors in drivers/hid/hid-core.c that can be triggered by a crafted HID device providing an invalid Report ID. The vulnerability allows physically proximate attackers to execute arbitrary code or cause a denial of servic...
CVE-2013-3301
CVE-2013-3301 affects the Linux kernel ftrace implementation up to version before 3.8.8. Local users with CAP_SYS_ADMIN can write to either set_ftrace_pid or set_graph_function and trigger an lseek, leading to a NULL pointer dereference and possible system crash or other impact. Multiple connecte...
CVE-2013-7265
CVE-2013-7265 affects the Linux kernel; the pn_recvmsg function in net/phonet/datagram.c updates a length value before the associated data structure is initialized, enabling local users to read sensitive kernel stack memory via recvfrom/recvmmsg/recvmsg calls. Impact is a local information leak. ...
CVE-2014-1446
CVE-2014-1446 affects the Linux kernel up to version 3.12.7, where the yam_ioctl handler in drivers/net/hamradio/yam.c fails to initialize a structure member. This can allow a local attacker with CAP_NET_ADMIN to leak kernel memory via an SIOCYAMGCFG ioctl, enabling information disclosure. The ex...
CVE-2014-8369
The CVE-2014-8369 flaw affects the Linux kernel and is caused by a miscalculation in kvm_iommu_map_pages (virt/kvm/iommu.c) when handling a mapping failure. The vulnerability exists in kernels up to 3.17.2 and arises from an incorrect fix for CVE-2014-3601. This allows guest OS users with privile...
CVE-2015-8569
The CVE-2015-8569 issue affects the Linux kernel’s PPTP path: pptp_bind() and pptp_connect() in drivers/net/ppp/pptp.c do not verify the length of the sockaddr, enabling a local attacker to copy kernel memory to user space and bypass KASLR via a crafted application. The vulnerability is present i...
CVE-2020-35513
CVE-2020-35513 describes a flaw in the Linux kernel NFS implementation where an incorrect umask during file/directory modification can be triggered when NFSv4.2 and a non-NFSv4.2 process access the NFS concurrently. The result is resource starvation leading to denial of service. The initial and c...
CVE-2021-47056
CVE-2021-47056 affects Linux kernel components involving the Intel QAT crypto path (qat_dh895xccvf, adf_iov_putmsg, adf_vf2pf_shutdown). The issue is that ADF_STATUS_PF_RUNNING was set unconditionally; vf2pf_lock is initialized in adf_dev_init() and may be uninitialized/destroyed if init fails, l...
CVE-2021-47138
In CVE-2021-47138, the Linux kernel cxgb4 driver is vulnerable because hardware registers for the server TID base can hold invalid values when the adapter is in a bad state (e.g., AER fatal error). Reading these values during filter clearing could cause out-of-bounds memory access. The fix uses t...
CVE-2021-47402
CVE-2021-47402 affects the Linux kernel’s net: sched: flower (cls_flower). The issue arises from a use-after-free when filters are deleted concurrently due to missing RCU protection during fl_walk() iteration after a patch refactor. The provided advisories state that fl_walk() must obtain the RCU...
CVE-2021-47410
CVE-2021-47410 concerns the Linux kernel where the AMDGPU/KFD stack emitted a warning trace due to the function svm_migrate_fini releasing device resources via devm_memunmap_pages and devm_release_mem_region after a patch that split amdgpu_device_fini into early/late phases. The root cause is the...
CVE-2021-47534
The CVE-2021-47534 entry concerns a Linux kernel DRM/VC4 KMS issue: a refcounting bug in the global HVS state caused leakage of drm_crtc_commit structures on every commit. The fix introduces drm_crtc_commit_put to prevent leakage, implemented in the patch chain around commit 9ec03d7f1ed3. Affecte...
CVE-2022-3078
CVE-2022-3078 affects Linux kernels up to 5.16-rc6; it arises from a lack of a post-allocation check after vzalloc() and a missing free in drivers/media/test-drivers/vidtv/vidtv_s302m.c. This can enable memory mismanagement within the affected driver. A fix is available in kernel patch history (e...
CVE-2022-40476
CVE-2022-40476: A NULL pointer dereference in fs/io_uring.c of the Linux kernel prior to 5.15.62 allows a local user to crash the system or potentially cause a denial of service. Affected software: Linux kernel (pre-5.15.62). Root cause: NULL pointer dereference in io_uring handling. Impact: loca...
CVE-2022-47938
Technical details are not publicly provided in the supplied documents. CVE-2022-47938 concerns ksmbd in the Linux kernel 5.15–5.19 before 5.19.2, with an out-of-bounds read during SMB2_TREE_CONNECT; monitor for updates.
CVE-2022-48628
The CVE-2022-48628 entry concerns a Linux kernel issue in ceph: drop messages from MDS when unmounting. The description in the primary doc states that during unmount, dirty buffers are flushed and after the last OSD request finishes, the last i_count reference is released and dirty caps/snaps are...
CVE-2022-48636
CVE-2022-48636 affects the Linux kernel, specifically the s390/dasd path. The issue is an Oops in dasd_alias_get_start_dev caused by a missing pavgroup dereference, created by a race: pavgroup can become NULL between function entry and _lcu_update(), when lcu->lock is not held. The patch fixes...
CVE-2022-48662
CVE-2022-48662 affects the Linux kernel i915 driver (i915_gem_context.link protection). The issue arises when removing a context from the gem.contexts list during context_close(), which can poison link.next while i915_perf holds a reference, leading to a general protection fault during i915_perf_...
CVE-2022-48664
CVE-2022-48664 concerns the Linux kernel, specifically the btrfs filesystem. The issue caused hangs during unmount when a space reclaim worker is stopped, usually observed as a long-blocked umount task in tests (e.g., generic/562). The described sequence shows the cleaner kthread starting a trans...
CVE-2022-48789
In CVE-2022-48789, the Linux kernel nvme-tcp transport error_recovery work contained a use-after-free risk caused by a race between submit_async_event and the error_recovery handler when destroying the admin queue. The fix requires flushing async_event_work before continuing to destroy the admin ...
CVE-2022-48994
CVE-2022-48994 affects the Linux kernel ALSA sequencing path. The issue arises from a prototype mismatch: seq_copy_in_user() and seq_copy_in_kernel() did not match snd_seq_dump_func_t, leading to -Wcast-function-type-strict checks with Clang. The patch fixes the function prototypes and removes ca...
CVE-2022-49027
CVE-2022-49027 pertains to the Linux kernel: the iavf_init_module() path failed to destroy a workqueue when pci_register_driver() failed, causing a resource leak. The fix adds a destroy_workqueue() call in the error path to prevent leaks, aligning with the handling in a related commit for usb/hot...
CVE-2022-49170
CVE-2022-49170 concerns the F2FS implementation in the Linux kernel. The root cause was a missing sanity check on curseg->alloc_type, which could widen an array-bounds access of sbi->block_count[] (UBSAN: array-index-out-of-bounds) when mounting/operating a corrupted image. The issue manife...
CVE-2022-49441
CVE-2022-49441 relates to a Linux kernel deadlock in tty handling. The root cause is a potential deadlock when kmalloc() path could trigger a printk() while holding tty_port->lock, enabling a cycle with console ownership locks. The described failing scenario involves multiple CPUs acquiring po...
CVE-2022-49930
CVE-2022-49930 affects the Linux kernel in the RDMA/hns path (free_mr_init) where a race can cause a NULL pointer dereference when a lock is grabbed concurrently without proper initialization. The vulnerability leads to an in-kernel NULL dereference (call trace beginning at __mutex_lock.constprop...
CVE-2023-52503
CVE-2023-52503: Linux kernel vulnerability in amdtee_close_session allows a local race causing use-after-free in amdtee_open_session due to non-atomic session destruction. The fix makes the decrement of sess->refcount and removal of sess from the session list an atomic/critical section in dest...
CVE-2023-52618
CVE-2023-52618 affects the Linux kernel’s block/rnbd-srv path. The issue stems from copying dev_search_path and a second string into full_path, each sized PATH_MAX, which could truncate. The root cause was a potential truncation in snprintf(full_path, PATH_MAX, "%s/%s", dev_search_path, dev_name)...
CVE-2023-52631
CVE-2023-52631 affects the Linux kernel NTFS3 path. The issue is a NULL dereference in ntfs_load_attr_list() caused by a 32-bit overflow in size calculation (le32_to_cpu(attr->res.data_size) + 1023), which can yield zero and make kmalloc return ZERO_SIZE_PTR, leading to a crash on memcpy. The ...
CVE-2023-52771
CVE-2023-52771 affects the Linux kernel CXL stack. The issue is a race between delete_endpoint() teardown and parent unregistration, which can impact the cxl_mem/cxl_port topology during port removal. The provided description states two fixes: (1) acquire a reference on the parent to prevent use‑...
CVE-2023-52774
CVE-2023-52774 : In the Linux kernel (s390/dasd), the device queue could be accessed concurrently in dasd_profile_start(), allowing the queue to change while it is being read; this could trigger a kernel panic due to invalid pointer accesses when I/O is highly parallel (aliases). The root cause i...
CVE-2023-53124
VULNERABILITY SUMMARY: CVE-2023-53124 fixes a NULL pointer dereference in the Linux kernel SCSI driver mpt3sas during transport_port_add. The port is created by sas_port_alloc_num() and rphy by sas_end_device_alloc() or sas_expander_alloc(), any of which may return NULL, and the code would access...
CVE-2024-26630
CVE-2024-26630 (Linux kernel) : The issue in cachestat stemmed from reading folio data from the page cache XRAY without holding a reference, allowing a folio to be released and reused during the operation. The fix switches to the xarray machinery for folio offsets and dirty/writeback state, preve...
CVE-2024-26714
CVE-2024-26714 affects the Linux kernel interconnect/qcom sc8180x module. Root cause: CO0 BCM must stay up as a keepalive to prevent hardware such as the UFS controller from losing connectivity, which can hang the platform and trigger heavy logspam. Documented fix marks CO0 BCM keepalive to ensur...
CVE-2024-38384
CVE-2024-38384 (Linux kernel) - The blk-cgroup subsystem had a race where reordering WRITE to the lqueued field with a READ of bisc->lnode.next inside __blkcg_rstat_flush() could corrupt a local list. The issue could occur anytime __blkcg_rstat_flush() runs, especially during blk_cgroup_bio_st...
CVE-2024-38582
CVE-2024-38582 affects the Linux kernel nilfs2, causing a potential hang/deadlock during unmount. The issue arises when nilfs_segctor_sync() tries to synchronize with the log writer thread after nilfs_segctor_destroy() has already terminated that thread, leading to a deadlock path through several...
CVE-2024-40987
Mode C: The CVE-2024-40987 issue affects the Linux kernel's DRM/amdgpu driver, where a UBSAN warning in kv_dpm.c is fixed by adding a bounds check for sumo_vid_mapping_entry. The patch targets the root cause (bounds check failure) and reports the fix as part of the kernel update. Public reference...
CVE-2024-41004
CVE-2024-41004 affects the Linux kernel tracing tests for build event generation in kprobes/synth tests. The vulnerability arises when those test modules are built-in instead of modular, causing events to remain locked in the kernel and breaking kprobe self-tests, which in turn causes ftracetest ...
CVE-2024-46842
CVE-2024-46842 is a Linux kernel SCSI lpfc issue. The mailbox command cleanup in lpfc_get_sfp_info does not correctly handle MBX_TIMEOUT, causing the same mailbox memory region to reference freed memory if firmware provides SFP information later. The root cause is failure to properly handle MBX_T...
CVE-2024-47664
The CVE affects the Linux kernel SPI driver for Hisilicon Kunpeng (spi: hisi-kunpeng). The root cause is a division by zero in hisi_calc_effective_speed() when max_speed_hz (provided by firmware) is 0. The firmware-supplied value is treated as trusted, but 0 is now explicitly invalidated, and an ...
CVE-2024-47731
CVE-2024-47731 affects the Linux kernel driver path: drivers/perf, specifically the ali_drw_pmu/ Alibaba uncore PMU handling. The vulnerability arises because the alibaba_uncore_pmu driver did not clear all interrupt statuses in its interrupt processing function, so after a PMU counter overflow a...
CVE-2024-49910
CVE-2024-49910 concerns the Linux kernel DRM/AMD display path. The root cause was a null dereference risk in drm/amd/display's dcn401_set_output_transfer_func: set_output_gamma could be non-null checked, then dereferenced. The fix adds a null check for set_output_gamma before invoking it, elimina...
CVE-2024-49980
CVE-2024-49980 affects the Linux kernel VRF path. The issue stems from removing an RCU-bh critical section around dev_queue_xmit_nit, which violated an invariant and could cause an inconsistent lock state, potentially enabling a deadlock during packet reception when BH is disabled. The vulnerabil...
CVE-2024-50034
CVE-2024-50034 affects the Linux kernel net/smc, where INET_PROTOSW_ICSK can leave icsk_sync_mss unset for IPPROTO_SMC, triggering a NULL pointer dereference panic. The provided trace indicates a kernel oops when handling IPPROTO_SMC, with a failed icsk_mss synchronization. A patch sequence in st...