CVE-2023-52994

Summary (CVE-2023-52994): In the Linux kernel, suspending a system under Xen PV could dereference NULL due to a missed code path in acpi_get_wakeup_address, caused by the commit that skipped realmode init for Xen PV guests. The fix adds an optional ACPI callback to skip setting the wakeup address...

CVE-2023-53008

CVE-2023-53008 (Linux kernel): CIFS session setup fix to prevent memory leaks by freeing cifs_ses::auth_key.response before allocating it. This addresses potential memory leaks during reconnect or mounting. The advisory states the fix in the CIFS session setup path; no exploit specifics are provi...

CVE-2024-26724

CVE-2024-26724 : In the Linux kernel, the mlx5 DPLL path (net/mlx5: DPLL) is affected by a use-after-free triggered by delayed-work timer handling. The issue is demonstrated by a KASAN slab-use-after-free in __run_timers and related callstack, with mlx5_dpll_probe allocating memory and mlx5_dpll_...

CVE-2024-26807

CVE-2024-26807 affects the Linux kernel via the cadence-quadspi driver path: runtime_suspend() and runtime_resume() incorrectly use dev_get_drvdata to retrieve a struct that is not a valid spi_controller pointer, causing memory corruption during PM runtime if probe enables PM runtime. Local impac...

CVE-2024-26887

The CVE-2024-26887 issue affects the Linux kernel Bluetooth stack, specifically btusb (and related btmtk coredump handling). The vulnerability is a memory leak that occurs when cloning skb conditioned on CONFIG_DEV_COREDUMP, with potential skb leakage in the coredump path. The issue has been fixe...

CVE-2024-35970

The CVE-2024-35970 issue affects the Linux kernel AF_UNIX socket path. The root cause is improper handling of OOB data: when an OOB skb is dequeued, unix_sock(sk)->oob_skb is not cleared, causing incorrect uAPI state and potential deadlocks. Repro shows a socketpair exchange where MSG_OOB is u...

CVE-2024-35980

CVE-2024-35980 affects the Linux kernel (arm64/KVM) where TLBI RANGE operand sorting could produce an incorrect address range during live migration, causing destination VMs to crash as some dirty pages were not flushed. The issue arises from how kvm_tlb_flush_vmid_range() interacts with __kvm_tlb...

CVE-2024-36003

CVE-2024-36003: Linux kernel ice driver deadlock in ice_reset_vf() due to lock order between VF config_lock and LAG mutex when ICE_VF_RESET_LOCK is involved. Connected advisories describe the issue as a possible circular locking dependency triggered on VF creation/removal, enabling a deadlock bet...

CVE-2024-36910

CVE-2024-36910 concerns the Linux kernel’s uio_hv_generic path. The issue arises when CoCo VMs allow set_memory_encrypted() or set_memory_decrypted() to fail, causing the operation to return an error while memory may be shared. The VMBus device UIO driver could then free decrypted/shared pages if...

CVE-2024-38549

CVE-2024-38549 affects the Linux kernel in the DRM/mediatek path: mtk_drm_gem_obj lacked a 0-byte allocation check, potentially leading to a kernel panic when a userspace app allocates a 0x0 GBM buffer. The fix adds a 0-byte allocation check in mtk_drm_gem_init, and testing on MT8188 confirms tha...

CVE-2024-38552

The CVE-2024-38552 issue affects the Linux kernel DRM/AMD display path, specifically the color transformation function. A potential index out-of-bounds can occur when i exceeds TRANSFER_FUNC_POINTS, risking buffer overflow in output_tf->tf_pts.red/green/blue. The fix adds a bounds check for i,...

CVE-2024-38577

CVE-2024-38577 affects the Linux kernel (rcu-tasks: show_rcu_tasks_trace_gp_kthread). The issue is a potential buffer overflow when counters passed to sprintf() are unrealistically large; the fix replaces sprintf() with snprintf() using a bounded buffer. Patches are incorporated in various adviso...

CVE-2024-40928

CVE-2024-40928 – Linux kernel ethtool statistics fix : The issue arises from a null function pointer in ethtool_get_phy_stats when performing phy stats ioctl. The patch fixes the error handling by returning -EOPNOTSUPP when ops->get_ethtool_phy_stats is NULL, preventing a null-dereference in n...

CVE-2024-40947

CVE-2024-40947 - Linux kernel ima vulnerability : The issue arises in the IMA policy path when a call to ima_lsm_copy_rule occurs inside an RCU read-side critical section, which can sleep due to kmalloc(GFP_KERNEL). This can cause synchronize_rcu to return early, potentially breaking RCU protecti...

CVE-2024-40971

The CVE-2024-40971 entries are supported by multiple connected advisories describing a Linux kernel/f2fs issue where the SB_INLINECRYPT flag is cleared in f2fs_remount and later re-set during option parsing. This can cause new files opened during the gap to bypass inlinecrypt, with potential data...

CVE-2024-40994

CVE-2024-40994 is a Linux kernel issue: in the ptp subsystem, an integer overflow in max_vclocks_store on 32‑bit systems when doing 4 * max can occur. The documented fix changes the allocation to use kcalloc() to prevent the overflow. The Azure Nessus entry confirms the vulnerability affects an A...

CVE-2024-42095

CVE-2024-42095 affects the Linux kernel component serial: 8250_omap, implementing Errata i2310. The issue allows an erroneous timeout that, if not cleared, can trigger a storm of interrupts per TI’s Errata i2310 (TI TI sprz536, page 23). Public records in connected sources consistently cite imple...

CVE-2024-42120

CVE-2024-42120 pertains to the Linux kernel, specifically a vulnerability in the DRM AMD display code. The issue is an OVERRUN caused by accessing the pipe_ctx array without validating an index against its MAX_PIPES size, which could lead to out-of-bounds access in the vblank handling path. The d...

CVE-2024-42299

CVE-2024-42299 : In the Linux kernel, the NTFS3 file system handler (fs/ntfs3) fixes an issue where log->page_mask and log->page_bits were not updated when log->page_size changed during log_replay after mounting an NTFS filesystem on a system with a different PAGE_SIZE. This mismatch cou...

CVE-2024-42319

CVE-2024-42319 (Linux kernel) : The issue affects the mailbox/CMDQ path (mtk-cmdq) where devm_mbox_controller_register() was invoked before devm_pm_runtime_enable(). On unbind, a WARN_ON can trigger due to pm_runtime_get_sync()

CVE-2024-43847

CVE-2024-43847 affects the Linux kernel wireless driver ath12k (reported under the Linux kernel vulnerability about fragmented packets). The issue arises when the monitor ring and the reo reinject ring share the same ring mask index; an interrupt on the reo reinject ring can cause the monitor rin...

CVE-2024-43860

CVE-2024-43860 affects the Linux kernel remoteproc component for imx_rproc. In imx_rproc_addr_init(), the code may dereference NULL during parsing because of_count_phandle_with_args() can yield empty phandles and of_parse_phandle() may return NULL. The fix adds a NULL-return check to prevent dere...

CVE-2024-44969

CVE-2024-44969 affects the Linux kernel, specifically the s390/sclp path. If a task waiting for a Store Data operation is interrupted and the halt attempt fails due to hardware/firmware issues, the SCLP facility might later store data into buffers referenced by the original operation. The fix pre...

CVE-2024-44991

CVE-2024-44991 affects the Linux kernel TCP stack: concurrent calls to tcp_sk_exit_batch() can race with inet_twsk_purge() across dying netns, risking timewait sockets of the exiting netns. The root cause: after the net/core/net_namespace change (commit that batches inet_twsk_purge), tcp_twsk_pur...

CVE-2024-46749

CVE-2024-46749 affects the Linux kernel Bluetooth driver btnxpuart. The vulnerability stems from a NULL pointer dereference in btnxpuart_flush(), which could crash the kernel when removing the driver after a failed or incomplete firmware download. The fix adds a guard before freeing rx->skb in...

CVE-2024-47662

The CVE-2024-47662 entry concerns the Linux kernel component drm/amd/display (DCN35 DMCUB diagnostics). The issue is that a diagnostic register read was removed to prevent triggering a security violation when DMCUB timeouts occur, blocking Z8 entry. The fix is to stop reading that register from t...

CVE-2024-47682

CVE-2024-47682 – Linux kernel scsi sd off-by-one fix (detailed in connected docs): The vulnerability arises in sd_read_block_characteristics() when a device returns page 0xb1 with length 8, potentially allowing an out-of-bounds memory access at offset 8 of the zoned field. The issue has been reso...

CVE-2024-49947

CVE-2024-49947 affects the Linux kernel net stack, specifically a vulnerability in virtio_net_hdr_to_skb() where an incorrectly set skb->csum_start could place the transport header before or after the network header when processing injected packets via af_packet. Syzbot-triggered warnings show...

CVE-2024-49979

CVE-2024-49979 affects the Linux kernel networking path (net: gso) where TCP fraglist SKBs with valid geometry can be mis-segmented after fragmentation list pulls. The fix detects invalid geometry caused by datapath hooks that pull data and switches from skb_segment_list to skb_segment, enabling ...

CVE-2024-50091

Summary: CVE-2024-50091 affects the Linux kernel driver path for dm-vdo, where the code may examine a dedupe_context pointer after ownership is lost. The vulnerability arises from not clearing the dedupe_context pointer in data_vio when ownership changes, enabling a potential misuse if the pointe...

CVE-2024-50165

CVE-2024-50165 is a Linux kernel vulnerability in the bpf_parse_param path (kernel/bpf/inode.c) where param->string was not preserved after parsing mount options, leading to a memory leak in kmem. The 8-byte leak and related stack traces were observed in kmemleak/memdup_user usage. The issue h...

CVE-2024-52559

The CVE-2024-52559 instance affects the Linux kernel’s DRM MSM driver: drm/msm/gem_submit() is vulnerable to an integer overflow when handling user-supplied submit->cmd[i].size and submit->cmd[i].offset (u32) via submit_lookup_cmds(). The issue is addressed by using size_add() to prevent wr...

CVE-2024-53062

Technical details for CVE-2024-53062 are not provided in the supplied documents. Monitor official advisories for patches and affected products; no root-cause, impact, or remediation details are available here.

CVE-2024-53211

CVE-2024-53211 : In the Linux kernel, the l2tp_exit_net path could observe a non-empty IDR due to a radix-tree internal-node condition when idr_is_empty() was used. The bug allowed idr_is_empty() to return false despite no items, triggering a warning and potentially unsafe destruction sequence. T...

CVE-2024-56657

CVE-2024-56657 relates to the Linux kernel ALSA: control path where WARN() was used for symlink creation errors. The fix downgrades these warnings to dev_err() and adds the function name to the prefix to reduce confusion (notably for fuzzers). This is a patch-level remediation described in Azure ...

CVE-2024-58097

CVE-2024-58097 | Affected software: Linux kernel driver ath11k (wifi) in PCI WLAN on certain chips. Issue: during monitor destination ring processing, MSDUs are reaped by buf_id; if a valid buffer for a buf_id cannot be obtained, an infinite loop occurs in destination processing, leading to kerne...

CVE-2025-21716

CVE-2025-21716 : In the Linux kernel, vxlan_vnifilter_dump() could access bytes beyond a netlink message when the payload length is smaller than sizeof(struct tunnel_msg), potentially causing an uninitialized-value access. The fix is to return an error if the payload is too short. Affected platfo...

CVE-2025-21737

CVE-2025-21737: Linux kernel memory-leak in ceph_mds_auth_match fixed by freeing the temporary target path substring allocation on all branches; leak could trigger memory growth and kernel OOM. Connected docs corroborate the fix in ceph_mds_auth_match and the impact described in production. No ad...

CVE-2025-21850

CVE-2025-21850 concerns the Linux kernel nvmet subsystem where a crash can occur when disabling a namespace while a percpu counter tracks pending I/O. The root cause is unsafe handling of the percpu counter during enable/disable cycles, which could lead to a crash (as observed in blktests/nvme/05...

CVE-2025-22101

CVE-2025-22101 affects the Linux kernel net:libwx path, where a bug set the Tx L4 checksum flag for non-TCP/UDP/SCTP offloads, causing the TX ring to hang. The fix switches to software checksumming for these packets to avoid the hang. No exploitation details are provided in the documents. Remedia...

CVE-2025-22116

CVE-2025-22116 affects the Linux kernel idpf driver’s netdev handling. The patch adds an error check when creating vports, logs the vport number and error code, and ensures on removal that VPORT_REG_NETDEV is checked before unregister/free. It also introduces local variables (idx, vport_config, n...

CVE-2025-23130

CVE-2025-23130 affects the Linux kernel F2FS code. The issue arises when fallocation fails for pinfile, risking a kernel panic in get_new_segment due to concurrent pinfile allocations exhausting free sections. The fix expands pin_sem lock coverage to include f2fs_gc to reclaim space, tightens err...

CVE-2025-37861

The CVE 2025-37861 pertains to the Linux kernel SCSI MPI3MR driver where the TM thread could process reply queues while the reset thread reinitializes them, causing an access to an invalid queue ID (0xFFFF) and a crash. The fix adds a synchronization flag io_admin_reset_sync. Before a reset, the ...

CVE-2025-37909

CVE-2025-37909 affects the Linux kernel net: lan743x subsystem. When GSO is enabled and fragments count is zero, skb is mapped to an EXT descriptor, preventing it from being freed and causing a memory leak. The fix maps the skb to the LS descriptor unconditionally, eliminating the memleak. This i...

CVE-2025-37949

CVE-2025-37949 concerns the Linux kernel XenBus code. The connected docs describe a NULL pointer dereference in xenbus_thread caused by a wake-up path where req may be freed before resuming, and the fix adds two separate kref lifetimes (one for the caller and one for xenbus_thread) with kref_put(...

CVE-2025-37956

CVE-2025-37956 affects the Linux kernel ksmbd server. A client can send an empty newname string when renaming a file or directory, which previously triggered a kernel oops in d_alloc. A patch has been applied to return an error when attempting to rename with an empty new name string, preventing t...

CVE-2025-37991

CVE-2025-37991 describes a PA-RISC (parisc) Linux kernel issue where a SIGFPE exception can crash an application if a second SIGFPE is delivered in the signal handler. The root cause is traced to glibc using a double-word floating-point store to atomically update function descriptors, causing a t...

CVE-2025-37993

CVE-2025-37993 refers to a Linux kernel issue where the m_can_classdev.tx_handling_spinlock was not initialized during device probe, causing a spinlock bad magic crash (notably when cansend is used). The problem is resolved by initializing the spin lock in m_can_class_allocate_dev. Affected conte...

CVE-2025-38049

CVE-2025-38049 (Linux kernel) : In x86 resctrl, allocation of the cleanest CLOSID could dereference NULL on platforms without LLC occupancy counters, causing a NULL pointer dereference when creating a new control group. The issue arises from code that searched for the CLOSID with the fewest dirty...

CVE-2026-43501

CVE-2026-43501 - Linux kernel IPv6 SRH headroom bug : The issue occurs in ipv6_rpl_srh_rcv() when decompressing and recompressing RFC 6554 Source Routing Headers, where the recompressed IPv6 header can grow beyond the received header. The root cause is an unsafe headroom handling in pskb_expand_h...