CVE-2024-40947

CVE-2024-40947 - Linux kernel ima vulnerability : The issue arises in the IMA policy path when a call to ima_lsm_copy_rule occurs inside an RCU read-side critical section, which can sleep due to kmalloc(GFP_KERNEL). This can cause synchronize_rcu to return early, potentially breaking RCU protecti...

CVE-2024-40987

Mode C: The CVE-2024-40987 issue affects the Linux kernel's DRM/amdgpu driver, where a UBSAN warning in kv_dpm.c is fixed by adding a bounds check for sumo_vid_mapping_entry. The patch targets the root cause (bounds check failure) and reports the fix as part of the kernel update. Public reference...

CVE-2024-41069

CVE-2024-41069 is a Linux kernel vulnerability in ASoC topology where references to freed memory were fixed. The changelog entries indicate root cause was pointers into topology file contents after parsing and releasing memory; the fix allocates memory via devm_kmemdup() to avoid dereferencing fr...

CVE-2024-41074

Technical details for CVE-2024-41074 are not publicly available in the provided documents. Monitor for updates from vendors and security advisories.

CVE-2024-42120

CVE-2024-42120 pertains to the Linux kernel, specifically a vulnerability in the DRM AMD display code. The issue is an OVERRUN caused by accessing the pipe_ctx array without validating an index against its MAX_PIPES size, which could lead to out-of-bounds access in the vblank handling path. The d...

CVE-2024-42287

Root cause: CVE-2024-42287 affects the Linux kernel SCSI qla2xxx path where command completion was done early in the unload path outside the lock, causing a race that could crash the system. The fix is to complete the command within the lock, avoiding the race with dma_free_attr and multiple comp...

CVE-2024-43860

CVE-2024-43860 affects the Linux kernel remoteproc component for imx_rproc. In imx_rproc_addr_init(), the code may dereference NULL during parsing because of_count_phandle_with_args() can yield empty phandles and of_parse_phandle() may return NULL. The fix adds a NULL-return check to prevent dere...

CVE-2024-46729

CVE-2024-46729 (Linux kernel) : Affected component is drm/amd/display. Root cause: incorrect size calculation for a loop due to fe_clk_en having size 5 but sizeof(fe_clk_en) equal to 20 bytes, leading to two overrun conditions. Mitigation: fix implemented by computing element count via dividing t...

CVE-2024-46811

CVE-2024-46811 affects the Linux kernel in the DRM/AMD display component. A potential out-of-bounds condition arises when accessing bw_params->clk_table.entries (8 entries) if soc.num_states can reach 40; the issue is fixed by asserting when soc.num_states exceeds 8 during fpu_update_bw_boundi...

CVE-2024-46823

CVE-2024-46823 concerns a Linux kernel issue in the kunit/overflow path for overflow_allocation_test. The root cause is that the local variable ‘device_name’ was used as a driver name outside its scope, causing a kernel panic when KASAN is enabled. The documented fix removes the out‑of‑scope usag...

CVE-2024-46842

CVE-2024-46842 is a Linux kernel SCSI lpfc issue. The mailbox command cleanup in lpfc_get_sfp_info does not correctly handle MBX_TIMEOUT, causing the same mailbox memory region to reference freed memory if firmware provides SFP information later. The root cause is failure to properly handle MBX_T...

CVE-2024-47663

Technical details about CVE-2024-47663 are not provided in the supplied documents. The entries summarize a kernel fix in ad9834 frequency handling but do not include vendor/product specifics or patch details. Monitor for updates.

CVE-2024-49976

CVE-2024-49976 concerns an ABBA deadlock in the Linux kernel related to timerlat/osnoise kthread handling. The issue arises because stop_kthread() (offline callback for trace/osnoise:online) could deadlock due to holding interface_lock while cpus_write_lock/cpus_read_lock paths are taken, enablin...

CVE-2024-49980

CVE-2024-49980 affects the Linux kernel VRF path. The issue stems from removing an RCU-bh critical section around dev_queue_xmit_nit, which violated an invariant and could cause an inconsistent lock state, potentially enabling a deadlock during packet reception when BH is disabled. The vulnerabil...

CVE-2024-50206

CVE-2024-50206 affects the Linux kernel MTK Ethernet driver (drivers/net/ethernet/mediatek/mtk_eth_soc.c). The vulnerability is in mtk_init_fq_dma(), where a loop allocated up to MTK_FQ_DMA_LENGTH descriptors may touch more descriptors than exist, causing memory corruption. The fix adjusts the lo...

CVE-2024-56580

Technical details are not provided in the supplied documents. Monitor official advisories for CVE-2024-56580.

CVE-2025-21716

CVE-2025-21716 : In the Linux kernel, vxlan_vnifilter_dump() could access bytes beyond a netlink message when the payload length is smaller than sizeof(struct tunnel_msg), potentially causing an uninitialized-value access. The fix is to return an error if the payload is too short. Affected platfo...

CVE-2025-21741

CVE-2025-21741 affects the Linux kernel usbnet/ipheth path. The bug is an out-of-bounds read in DPE handling within usbnet, where the number of processed DPEs could exceed the fixed-size NDP16 header. The advisory fix limits processing to the number that fits in the NDP16 header to prevent OoB re...

CVE-2025-21768

Technical details for CVE-2025-21768 are not publicly provided in the supplied documents. Monitor for updates from the linked advisories and security feeds.

CVE-2025-21775

CVE-2025-21775 affects the Linux kernel CAN ctucanfd component. When skb allocation fails, the can_frame pointer can be NULL, and one NULL check was missed in ctucan_err_interrupt(); a fix adding the NULL check was implemented in the kernel (see references to the can: ctucanfd: handle skb allocat...

CVE-2025-21815

CVE-2025-21815 affects the Linux kernel, specifically the memory management path in mm/compaction (isolate_freepages_block). The issue stems from a UBSAN shift-out-of-bounds warning caused by (1UL <

CVE-2025-21850

CVE-2025-21850 concerns the Linux kernel nvmet subsystem where a crash can occur when disabling a namespace while a percpu counter tracks pending I/O. The root cause is unsafe handling of the percpu counter during enable/disable cycles, which could lead to a crash (as observed in blktests/nvme/05...

CVE-2025-23130

CVE-2025-23130 affects the Linux kernel F2FS code. The issue arises when fallocation fails for pinfile, risking a kernel panic in get_new_segment due to concurrent pinfile allocations exhausting free sections. The fix expands pin_sem lock coverage to include f2fs_gc to reclaim space, tightens err...

CVE-2025-37853

Mode C: CVE-2025-37853 affects the Linux kernel DRM/AMDKFD debugfs hang_hws interface for MES path, where a NULL pointer dereference (dqm->packet_mgr not set up) can crash the kernel during MES GPU reset testing. The advisory notes the issue is resolved by skipping MES for now and that MES han...

CVE-2025-37903

The CVE-2025-37903 issue affects the Linux kernel DRM/AMD display path (drm/amd/display) in the amdgpu_dm_hdcp.c handling. The root cause is that the HDCP code copies pointers to amdgpu_dm_connector objects without incrementing their kref reference counts. In a USB‑C dock scenario, unplugging fre...

CVE-2025-37944

CVE-2025-37944 affects the Linux kernel wifi stack (ath12k). The root cause is in ath12k_dp_mon_srng_process, which incorrectly uses ath12k_hal_srng_src_get_next_entry to fetch entries from the destination ring. This misapplied function leads to invalid memory access, risking data corruption or c...

CVE-2025-37952

CVE-2025-37952 describes a use-after-free in ksmbd within the Linux kernel. A thread destroying a file via __ksmbd_close_fd can race with another thread holding a reference to the same file, because the existing fp->refcount checks do not prevent the issue. The fix adds ft->lock around the ...

CVE-2025-38106

Mode C: Concrete details found. The CVE-2025-38106 issue is in the Linux kernel io_uring/sqpoll path, where a use-after-free of sq->thread could occur when __io_uring_show_fdinfo() uses a freed task_struct. The SUSE/OpenSUSE advisory notes the fix: assign and look up sq->thread under RCU wi...

CVE-2025-38461

CVE-2025-38461 affects the Linux kernel vsock transport code. Root cause: a TOCTOU race where transport assignment could race with module unload, risking a stale pointer and potential instability. The fix adds protection for new_transport and a lockdep assertion; updated kernels are released (exa...

CVE-2025-40364

CVE-2025-40364 : In the Linux kernel, the io_uring path titled “io_req_prep_async with provided buffers” has been resolved. The issue allowed io_req_prep_async() to import provided buffers and then commit the ring state by giving up on that path, with the buffers potentially being reimported late...

CVE-2026-31607

CVE-2026-31607 (Linux kernel USB/IP) : A RET_SUBMIT response can cause an out-of-bounds write when usbip_pack_ret_submit() overwrites urb->number_of_packets without validation. The loop bound in usbip_recv_iso()/usbip_pad_iso() then writes beyond urb->iso_frame_desc[], triggering a heap OOB...

CVE-2026-46113

CVE-2026-46113 (Linux kernel KVM x86 shadow paging use-after-free) is a resolved vulnerability in the KVM shadow paging path. The issue arises when the shadow MMU computes GFNs for direct shadow pages using sp->gfn plus the SPTE index and guest page-table modifications between VM entries can c...

CVE-2009-2910

CVE-2009-2910 affects the Linux kernel’s ia32 entry path on x86_64. The issue is that arch/x86/ia32/ia32entry.S does not clear certain kernel registers before returning to user mode, which allows a local attacker to read register values from an earlier process after switching an ia32 process into...

CVE-2009-3620

CVE-2009-3620 affects the ATI Rage 128 (r128) driver in the Linux kernel, where the driver fails to properly verify Concurrent Command Engine (CCE) state initialization. This local vulnerability can cause a NULL pointer dereference and system crash (DoS) and may allow privilege escalation via uns...

CVE-2012-1090

CVE-2012-1090 affects the Linux kernel: the cifs_lookup function in fs/cifs/dir.c can trigger a local denial of service (OOPS) when a local user accesses a specially crafted file (e.g., a FIFO). The issue exists in kernel versions prior to 3.2.10. Exploitation requires local access. The documente...

CVE-2013-0268

The CVE-2013-0268 issue affects the Linux kernel, specifically the msr_open function in arch/x86/kernel/msr.c, vulnerable before version 3.7.6. The vulnerability allows local unprivileged users to bypass capability restrictions and gain root by running a crafted application (msr32.c). Affected co...

CVE-2013-1792

The CVE-2013-1792 entry is valid and has concrete details in connected documents: a race condition in the Linux kernel’s install_user_keyrings() (security/keys/process_keys.c) allows local users to trigger a NULL pointer dereference and crash via concurrent keyctl calls. The vulnerability affects...

CVE-2013-1796

CVE-2013-1796 affects the Linux kernel KVM MSR_KVM_SYSTEM_TIME handling: the kvm_set_msr_common path in arch/x86/kvm/x86.c does not ensure time_page alignment for MSR_KVM_SYSTEM_TIME when the kernel is

CVE-2014-3185

CVE-2014-3185 affects the Linux kernel’s Whiteheat USB Serial Driver (drivers/usb/serial/whiteheat.c). The vulnerability allows physically proximate attackers to execute arbitrary code or cause a denial of service (memory corruption and system crash) by presenting a crafted USB device that suppli...

CVE-2014-9728

CVE-2014-9728 concerns the Linux kernel UDF filesystem before 3.18.2, where missing validation of certain lengths in fs/udf/inode.c and fs/udf/symlink.c can enable a local attacker to trigger a denial of service via a crafted UDF image, potentially causing a buffer over-read and system crash. The...

CVE-2014-9803

CVE-2014-9803 affects the Linux kernel and Android deployments using affected kernels prior to 3.15-rc5-next-20140519 (notably on Nexus 5X/6P before 2016-07-05). The issue arises in arch/arm64/include/asm/pgtable.h where execute-only pages are mishandled, enabling a local attacker to gain privile...

CVE-2014-9904

CVE-2014-9904 affects the Linux kernel ALSA subsystem: snd_compress_check_input in sound/core/compress_offload.c before 3.17 fails to check for an integer overflow. This can allow local users to cause a denial of service (insufficient memory allocation) or other unspecified impact via a crafted S...

CVE-2016-2548

CVE-2016-2548 affects the Linux kernel’s sound/core/timer.c prior to 4.4.1. The issue arises because the kernel may retain certain linked lists after a close or stop action (snd_timer_close and _snd_timer_stop), enabling a local attacker to trigger a denial-of-service (system crash) via a crafted...

CVE-2016-3713

CVE-2016-3713 affects the Linux kernel up to version 4.6.0 (fixed in 4.6.1). The vulnerability lies in msr_mtrr_valid() in arch/x86/kvm/mtrr.c, which incorrectly supports MSR 0x2f8 and allows a guest OS user to read or write the kvm_arch_vcpu data structure. Impact includes potential information ...

CVE-2017-18379

CVE-2017-18379 is an issue in the Linux kernel prior to 4.14, where an out-of-bounds access occurs in the nvme target driver, specifically in drivers/nvme/target/fc.c. The connected Nessus advisories (Unity Linux UTSA-2026-001233/002545/002935) reference the same vulnerability and reiterate that ...

CVE-2019-18675

CVE-2019-18675 affects the Linux kernel up to version 5.3.13, due to a start_offset+size integer overflow in cpia2_remap_buffer (drivers/media/usb/cpia2/cpia2_core.c) when cpia2 uses its own mmap. This allows a local user with access to /dev/video0 to read/write kernel physical pages, potentially...

CVE-2019-18813

CVE-2019-18813 is tied to a memory leak in the Linux kernel’s dwc3_pci_probe() (drivers/usb/dwc3/dwc3-pci.c). The issue is present in kernel versions up to 5.3.9 and allows a remotely-triggered denial of service by causing memory consumption when platform_device_add_properties() fails. The connec...

CVE-2021-46977

CVE-2021-46977 (Linux Kernel KVM VMX) : The vulnerability arises from preemption of the host while probing user return MSRs via RDMSR/WRMSR. If the MSR value differs per logical CPU, a WRMSR could corrupt the host value if KVM is preempted between the RDMSR and WRMSR and rescheduled on another CP...

CVE-2021-47372

CVE-2021-47372 is a Linux kernel use-after-free in the macb driver. The issue arises from plat_dev->dev->platform_data being released by platform_device_unregister() and subsequently using pclk and hclk, leading to use-after-free in macb_remove. The fixed sequence avoids using the clk devic...

CVE-2021-47520

Summary (CVE-2021-47520): A Linux kernel issue in can: pch_can: pch_can_rx_normal leads to a use-after-free when dereferencing skb after netif_receive_skb(skb); the can_frame cf aliases skb memory and is dereferenced immediately after. The documented fix is a reordering of lines to prevent derefe...