CVE-2025-23130

CVE-2025-23130 affects the Linux kernel F2FS code. The issue arises when fallocation fails for pinfile, risking a kernel panic in get_new_segment due to concurrent pinfile allocations exhausting free sections. The fix expands pin_sem lock coverage to include f2fs_gc to reclaim space, tightens err...

CVE-2025-37952

CVE-2025-37952 describes a use-after-free in ksmbd within the Linux kernel. A thread destroying a file via __ksmbd_close_fd can race with another thread holding a reference to the same file, because the existing fp->refcount checks do not prevent the issue. The fix adds ft->lock around the ...

CVE-2025-37954

CVE-2025-37954 affects the Linux kernel SMB client path, specifically a race in find_or_create_cached_dir/open_cached_dir. A valid cfid returned during find_or_create_cached_dir could race with a lease-break, causing open_cached_dir to treat the cfid as invalid and potentially leak a dentry refer...

CVE-2025-37991

CVE-2025-37991 describes a PA-RISC (parisc) Linux kernel issue where a SIGFPE exception can crash an application if a second SIGFPE is delivered in the signal handler. The root cause is traced to glibc using a double-word floating-point store to atomically update function descriptors, causing a t...

CVE-2025-37999

The CVE-2025-37999 issue affects the Linux kernel's EROFS fileio path. When bio_add_folio() fails, erofs_fileio_scan_folio() submits a new I/O request and retries with an empty bio, but erofs_onlinefolio_split() had already run, incrementing folio->private. The retry then calls erofs_onlinefol...

CVE-2025-38062

CVE-2025-38062 affects the Linux kernel genirq/msi path. Root cause: the IOMMU translation for MSI messages was split into two steps, with a cookie holding the IOVA between steps; lack of irq-layer locking allowed the IOMMU domain to change during VFIO/migration, creating a use-after-free risk fo...

CVE-2025-38064

The CVE-2025-38064 entry concerns the Linux kernel virtio subsystem, specifically virtio-console, where devices continue to write to MMIO after the underlying virtio-pci device is reset, causing hangs in kexec-in-VM scenarios. The issue is mitigated by the kernel fix that breaks all virtio device...

CVE-2025-38320

CVE-2025-38320 affects the Linux kernel on arm64/ptrace, describing a stack-out-of-bounds read in regs_get_kernel_stack_nth() detected by KASAN. The issue is illustrated by a long kernel trace showing a read of size 8 at a stack address belonging to task 1.sh/2550, with the buggy frame located in...

CVE-2025-38494

CVE-2025-38494 (Linux kernel) : In the HID core, hid_hw_raw_request() checks were bypassed by a low-level transport path, allowing the use of invalid parameters. The vulnerability was resolved in the Linux kernel; advisories from Debian/Amazon/RHEL references confirm the fix. Impact is high (loca...

CVE-2026-31705

The CVE-2026-31705 issue affects the ksmbd component of the Linux kernel, where an out-of-bounds write occurs in smb2_get_ea() during EA alignment padding. After writing each EA entry, a 4-byte alignment padding is applied with memset() unconditionally, potentially overwriting adjacent kernel hea...

CVE-2026-53228

The CVE-2026-53228 entry documents a vulnerability in the Linux kernel SIT IPv6 tunnel driver. When GSO offloads are used, the code may keep a stale pointer to the inner IPv6 header after skb header unclone and potential headroom reallocation, leading to reads from freed memory. A fix reloads the...

CVE-2003-0127

The Linux kernel version 2.2.x before 2.2.25 and 2.4.x before 2.4.21 contains a vulnerability in the kernel module loader . This flaw allows local users to escalate privileges to root by utilizing ptrace to attach to a child process spawned by the kernel. While specific exploit links are not prov...

CVE-2004-0554

CVE-2004-0554 affects the Linux kernel (2.4.x and 2.6.x on x86). The root cause is a local-denial-of-service condition triggered by an infinite loop that abuses a sequence of fsave/frstor instructions in a signal handler (as demonstrated by crash.c). The practical impact is a system crash/DoS wit...

CVE-2009-0745

CVE-2009-0745 concerns the Linux kernel ext4 resize path. The ext4_group_add function in fs/ext4/resize.c fails to properly initialize the group descriptor during a resize (resize2fs), which can allow a local attacker to trigger a denial of service (OOPS) by manipulating crafted values in memory....

CVE-2009-2695

CVE-2009-2695 affects the Linux kernel before 2.6.31-rc7, where mmap operations targeting page zero and other low memory addresses are not properly prevented. This enables local privilege escalation via NULL pointer dereference vulnerabilities, linked to (1) SELinux’s allow_unconfined_mmap_low se...

CVE-2009-3612

CVE-2009-3612 affects the Linux kernel’s net/sched/cls_api.c tcf_fill_node in the netlink subsystem. The issue is that a tcm__pad2 structure member is not initialized, potentially allowing local attackers to read sensitive kernel memory. Affected: kernel 2.6.x prior to 2.6.32-rc5 and 2.4.37.6 and...

CVE-2010-0307

CVE-2010-0307 affects the Linux kernel (x86_64) prior to 2.6.32.8 where load_elf_binary in fs/binfmt_elf.c may call SET_PERSONALITY before confirming the ELF interpreter exists, enabling a local DoS via a 32-bit process launching a 64-bit one and triggering a segmentation fault (flush_old_exec re...

CVE-2011-1171

CVE-2011-1171 affects the Linux kernel prior to 2.6.39, specifically the IPv4 netfilter ip_tables.c path. The issue is that string data in certain structure members may not end with the expected null terminator, enabling a local attacker with CAP_NET_ADMIN to craft a request and read the argument...

CVE-2011-4110

CVE-2011-4110 is a vulnerability in the Linux kernel 2.6 that affects the user_update function in security/keys/user_defined.c. The issue allows local users to trigger a denial of service via a NULL pointer dereference and kernel oops when updating a negative key into a fully instantiated key. Ex...

CVE-2011-5321

The vulnerability CVE-2011-5321 affects the Linux kernel up to version 3.1.0, specifically the tty_open function in drivers/tty/tty_io.c, where a driver-lookup failure can lead to a NULL pointer dereference and system crash via crafted access to /dev/pts devices. Local users can cause a denial of...

CVE-2012-6545

The CVE-2012-6545 issue affects the Linux kernel Bluetooth RFCOMM implementation. The connected MiracleLinux advisory documents this vulnerability as: before version 3.6, RFCOMM does not properly initialize certain structures, allowing a local attacker to obtain sensitive information from kernel ...

CVE-2013-2232

CVE-2013-2232 affects the Linux kernel prior to 3.10. The vulnerable code is the ip6_sk_dst_check function in net/ipv6/ip6_output.c; it lets a local user cause a denial-of-service (system crash) by using an AF_INET6 socket to connect to an IPv4 interface. A remedy is the upstream patch applied in...

CVE-2013-2234

CVE-2013-2234: In the Linux kernel (net/key/af_key.c), the functions key_notify_sa_flush and key_notify_policy_flush do not initialize certain structure members in versions before 3.10, allowing local users to read sensitive information from kernel heap memory via a broadcast message on the IPSec...

CVE-2014-1446

CVE-2014-1446 affects the Linux kernel up to version 3.12.7, where the yam_ioctl handler in drivers/net/hamradio/yam.c fails to initialize a structure member. This can allow a local attacker with CAP_NET_ADMIN to leak kernel memory via an SIOCYAMGCFG ioctl, enabling information disclosure. The ex...

CVE-2014-7826

CVE-2014-7826 affects the Linux kernel up to 3.17.2, where kernel/trace/trace_syscalls.c in the ftrace subsystem mishandles private syscall numbers. This can allow a local user to gain privileges or cause a denial of service via an crafted application (invalid pointer dereference). Connected advi...

CVE-2016-5344

CVE-2016-5344 affects the MDSS driver in the Linux kernel 3.x, used in Qualcomm QuIC Android MSM contributions. The root cause is multiple integer overflows triggered by large size values in mdss_compat_utils.c, mdss_fb.c, and mdss_rotator.c, potentially causing denial of service and possibly oth...

CVE-2018-14611

CVE-2018-14611 affects the Linux kernel up to version 4.17.10. The vulnerability is a use-after-free in try_merge_free_space() when mounting a crafted Btrfs image, caused by missing chunk type flag checks in fs/btrfs/volumes.c via btrfs_check_chunk_valid . In the provided connected documents, Nes...

CVE-2021-3714

CVE-2021-3714 (Linux kernel) affects the kernel’s memory deduplication mechanism. The connected sources describe a local-exploitation style attack where an adversary can upload page-sized files and observe access-time changes from a networked service to infer whether pages have been merged. This ...

CVE-2021-47267

The Linux kernel contains a vulnerability in the usb_assign_descriptors() function within the drivers/usb/gadget/config.c module. If a gadget driver provides a NULL descriptor for super-speed-plus (USB3.1 - 10Gbps) and is utilized in a 10Gbps configuration, it triggers a null pointer dereference ...

CVE-2021-47438

CVE-2021-47438 affects the Linux kernel mlx5 driver; the root cause is a memory leak in net/mlx5e/ mlx5_core_destroy_cq() where on error path the destroy flow may not complete. The patch fixes this by ensuring the full destroy sequence runs before returning an error and by moving mlx5_debug_cq_re...

CVE-2022-47941

The CVE-2022-47941 issue affects ksmbd in Linux kernels 5.15–5.19 prior to 5.19.2. The root cause is a missing kfree in smb2pdu error paths in fs/ksmbd/smb2pdu.c, causing a memory leak. Impact is availability concerns due to memory leaks; no confidentiality or integrity impact stated. Affected ve...

CVE-2022-48794

CVE-2022-48794 affects the Linux kernel wireless stack for the IEEE 802.15.4 at86rf230 driver. On error, ieee802154_xmit_complete() is not invoked and skb structures are leaked after manual wake_queue() calls in Tx paths. The fix described in the sources is to free the skb upon error before retur...

CVE-2022-49340

The CVE-2022-49340 entry refers to the Linux kernel GRE/IPGRE path where ipgre_xmit validates csum_start for CHECKSUM_PARTIAL packets. The issue arose when skb_pull and GRE with TUNNEL_CSUM could cause an overflow via lco_csum if skb_checksum_start(skb) was compared against skb->data without p...

CVE-2022-49622

CVE-2022-49622 (Linux kernel) describes a use-after-free risk in nf_tables when verdict is NF_STOLEN in netfilter, where skb freeing may have occurred. The fix prevents illegal skb access by: (1) caching skb->nf_trace in the trace state and refreshing it when verdict != STOLEN; (2) skipping sk...

CVE-2022-49667

The CVE-2022-49667 issue is a Linux kernel net bonding use-after-free bug triggered by 802.3ad slave unbind. The flaw occurs when bond_3ad_unbind_slave clears an aggregator while there are still ports referencing freed memory, due to ad_clear_agg being invoked even when the port count in a group ...

CVE-2022-49923

The CVE affects the Linux kernel nxp-nci path (nfc: nxp-nci: Fix potential memory leak in nxp_nci_send). The root cause is that nxp_nci_send() frees the allocated skb only on nxp_nci_i2c_write() failure; when the write succeeds, nxp_nci_i2c_write() does not free the skb, causing a memory leak. A ...

CVE-2022-50228

CVE-2022-50228 is a Linux kernel vulnerability affecting KVM on x86 with SVM. The issue occurs when userspace can inject an interrupt with GIF=0, which can trigger a kernel BUG (fatal crash) in arch/x86/kvm/svm/svm.c. The provided descriptions explicitly show a kernel BUG at svm_inject_irq and an...

CVE-2023-50431

CVE-2023-50431 concerns the Linux kernel driver path sec_attest_info in drivers/accel/habanalabs/common/habanalabs_ioctl.c, where info->pad0 is not initialized, allowing an information leak to user space. The vulnerability affects the Linux kernel up to versions around 6.6.5 (per the provided ...

CVE-2023-52576

In the Linux kernel, the following vulnerability has been resolved: x86/mm, kexec, ima: Use memblock_free_late() from ima_free_kexec_buffer() The code calling ima_free_kexec_buffer() runs long after the memblockallocator has already been torn down, potentially resulting in a useafter free in memb...

CVE-2023-52627

In the Linux kernel, the following vulnerability has been resolved: iio: adc: ad7091r: Allow users to configure device events AD7091R-5 devices are supported by the ad7091r-5 driver together withthe ad7091r-base driver. Those drivers declared iio events for notifyinguser space when ADC readings f...

CVE-2023-52641

CVE-2023-52641 : Linux kernel vulnerability in the ntfs3 file system driver. A NULL pointer dereference could occur at the end of attr_allocate_frame(); a patch adds NULL pointer checks and directs exit via the out: label to avoid dereference of debugging helpers. The issue is resolved by this fi...

CVE-2023-52939

Summary of CVE-2023-52939 (Linux kernel): The vulnerability is in the memory control group (memcg) path of the Linux kernel, specifically in mm: memcg: fix NULL pointer in mem_cgroup_track_foreign_dirty_slowpath(). The root cause arises after the hwpoison patch that forcibly uncharges a LRU hwpoi...

CVE-2023-53071

CVE-2023-53071 affects the Linux kernel WiFi driver mt76. The root cause was calling ieee80211_unregister_hw unconditionally when probing a mt7921e PCI card without firmware, which could lead to a NULL pointer dereference on driver removal. The fix ensures mt76_unregister_device is invoked only f...

CVE-2023-53094

CVE-2023-53094 affects the Linux kernel tty/serial fsl_lpuart driver. A race can occur when a DMA RX completion finishes during RX DMA shutdown, causing a NULL dereference on sport->dma_rx_desc. The documented fix is to fold del_timer_sync() into lpuart_dma_rx_free() after dmaengine_terminate_...

CVE-2023-53134

CVE-2023-53134 is a Linux kernel issue affecting the bnxt_en driver where 4K-page systems could experience memory-allocation failure when tracking concurrent TPA (GRO/LRO) completions on 4K pages (up to 256 on P5). The root cause was an order-5 allocation for TPA data. The patch changes allocatio...

CVE-2024-26724

CVE-2024-26724 : In the Linux kernel, the mlx5 DPLL path (net/mlx5: DPLL) is affected by a use-after-free triggered by delayed-work timer handling. The issue is demonstrated by a KASAN slab-use-after-free in __run_timers and related callstack, with mlx5_dpll_probe allocating memory and mlx5_dpll_...

CVE-2024-26788

CVE-2024-26788 affects Linux kernel’s dmaengine: fsl-qdma. The concrete issue is that qDMA IRQs could be enabled before registers were configured, allowing pending interrupts from the primary kernel to reach the irq handler prematurely and cause a panic. The connected Astra Linux advisory confirm...

CVE-2024-26869

CVE-2024-26869 affects the Linux kernel in the f2fs subsystem. The root cause is a race in invalidating meta inode pages during GC, which can cause data corruption. The fix replaces invalidate_mapping_pages() with truncate_inode_pages_range() to ensure meta_inode pages are dropped safely. Several...

CVE-2024-35932

CVE-2024-35932 affects the Linux kernel DRM VC4 driver. The issue is in non-blocking commits where the check plane->state->fb == state->fb is not reliably protected, causing potential refcount underflow across prepare_fb/cleanup_fb. The root cause is that drm_plane.state should not be ac...

CVE-2024-35940

In the Linux kernel, the following vulnerability has been resolved: pstore/zone: Add a null pointer check to the psz_kmsg_read kasprintf() returns a pointer to dynamically allocated memorywhich can be NULL upon failure. Ensure the allocation was successfulby checking the pointer validity.