CVE-2011-2203

CVE-2011-2203 affects the Linux kernel (2.6.x) as cited in MiracleLinux AXSA:2012-220:01. The hfs_find_init function can crash the kernel (NULL pointer dereference) and trigger a kernel OOPs when mounting an HFS filesystem with a malformed MDB extent record, enabling a local DoS. The MiracleLinux...

CVE-2013-1767

CVE-2013-1767 is a Use-after-Free vulnerability in the Linux kernel’s shmem_remount_fs (mm/shmem.c) that allows local users to gain privileges or cause a denial of service by remounting a tmpfs without the mempolicy option. Affected: Linux kernel versions before 3.7.10. Impact per sources: local ...

CVE-2013-2234

CVE-2013-2234: In the Linux kernel (net/key/af_key.c), the functions key_notify_sa_flush and key_notify_policy_flush do not initialize certain structure members in versions before 3.10, allowing local users to read sensitive information from kernel heap memory via a broadcast message on the IPSec...

CVE-2014-9900

CVE-2014-9900 affects the Linux kernel (ethtool_get_wol in net/core/ethtool.c) up to version 4.7. It can leak kernel memory due to uninitialized data, enabling local information disclosure. Reported impact seen on Android devices (Nexus 5/2013 era) with Android before 2016-08-05. Public advisorie...

CVE-2015-2042

CVE-2015-2042 affects the Linux kernel (pre-3.19). The vulnerability lies in net/rds/sysctl.c where an incorrect data type in a sysctl table can allow local users to read potentially sensitive kernel memory via a sysctl entry, with unspecified other impact. Affected products include kernel builds...

CVE-2016-2549

CVE-2016-2549 affects the Linux kernel prior to version 4.4.1, where sound/core/hrtimer.c fails to prevent recursive callback access, enabling local users to trigger a denial of service (deadlock) via a crafted ioctl. Connected advisories (Unity Linux UTSA-2026-000840/000...) confirm this issue i...

CVE-2020-36780

Mode C: The CVE-2020-36780 issue concerns the Linux kernel i2c Sprd driver. The root cause is a reference leak where pm_runtime_get_sync increments the device PM reference count on return even when the operation failed, in sprd_i2c_master_xfer() and sprd_i2c_remove(). The fix replaces the increme...

CVE-2020-36788

CVE-2020-36788 affects the Linux kernel DRM/Nouveau: when nouveau_bo_init() fails, the underlying memory may be freed twice due to a use-after-free in the BO init path. The description explains that nouveau_bo_init() delegates to ttm_bo_init(), and on failure ttm_bo_init() calls a destructor that...

CVE-2021-4439

Mode C: The connected Nessus/OpenVAS entries confirm CVE-2021-4439 affects the Linux kernel isdn/capi/kcapi.c and relates to cmtp session handling. The root cause is an array-index-out-of-bounds when detaching a controller that is not yet attached, triggering an out-of-bounds access (-1) in a 32-...

CVE-2021-46982

CVE-2021-46982 relates to the Linux kernel’s f2fs compress path. A race between truncate and overwrite can leave a reference on a page, causing find_lock_page to return NULL after truncation. Root cause involves prepare_compress_overwrite, f2fs_pagecache_get_page, and subsequent truncate_setsize/...

CVE-2021-47070

CVE-2021-47070 is described in the connected docs as a Linux kernel vulnerability in the uio_hv_generic driver where memory allocated by vmbus_alloc_ring() during probe is leaked in error handling paths. The fix adds a missing vmbus_free_ring() call, noting that the memory is already freed in the...

CVE-2021-47315

CVE-2021-47315 affects the Linux kernel memory driver fsl_ifc (fsl_ifc_ctrl_probe). The issue is a leak of IO memory on probe failure due to not releasing gregs on error, as reported by Smatch. The resolved description states the fix is to unmap the IO memory when probe errors occur. The impact d...

CVE-2021-47345

Concrete details found: CVE-2021-47345 affects the Linux kernel’s RDMA/cma path, specifically a memory leak in rdma_resolve_route() when called repeatedly on the same rdma_cm_id. The trigger described in multiple sources is that cma_query_handler() may cause RDMA_CM_EVENT_ROUTE_ERROR, returning t...

CVE-2021-47354

CVE-2021-47354 affects the Linux kernel’s DRM scheduler. The issue arises from not waiting for all dependencies of a job to complete before terminating it, which could lead to data corruption. The published notes describe the vulnerable component as the kernel’s DRM/sched path and the fix as ensu...

CVE-2021-47595

CVE-2021-47595 affects the Linux kernel net/sched sch_ets. The vulnerability arises when the ETS qdisc changes (ets_qdisc_change) cause list_del corruption, leading to kernel BUG checks (invalid opcode in list_debug.c) and a system crash. The provided traces show the crash occurs in ets_qdisc_cha...

CVE-2022-3077

CVE-2022-3077 : A buffer overflow vulnerability in the Linux kernel Intel iSMT SMBus host controller driver, exposed via I2C_SMBUS (I2C_SMBUS_BLOCK_PROC_CALL) with malicious input. Local users can crash the system. Documents consistently reference this CVE in multiple advisories/plugins (e.g., Mi...

CVE-2022-4127

CVE-2022-4127 : A NULL pointer dereference in the Linux kernel function io_files_update_with_index_alloc can allow a local user to crash the system, causing a denial of service. The vulnerability affects the kernel and is documented across multiple sources (NVD/OSV/CNVD, Nessus/NASL entries). Som...

CVE-2022-48630

CVE-2022-48630 affects the Linux kernel crypto: qcom-rng. The issue is an infinite loop in qcom_rng_read() when max is not a multiple of WORD_SZ, caused by removing a break in the else branch. The fix re-adds the break (a simple patch) to avoid looping. The vulnerability was demonstrated/tested o...

CVE-2022-49085

CVE-2022-49085 affects the Linux kernel’s drbd path, fixing five use-after-free bugs in get_initial_state where skb could be freed and later dereferenced. The issue arises when notify_initial_state_done and subsequent notify_*_state_change calls free skb on error, leading to a use-after-free via ...

CVE-2022-49701

CVE-2022-49701 affects the Linux kernel ibmvfc SCSI driver. The issue arises because sub-queues and event pool resources were allocated/freed for every CRQ connection event (e.g., reset, LPM) instead of only during probe/remove, creating a race window and potential list corruption when queues are...

CVE-2022-49910

CVE-2022-49910 (Linux kernel) : A race between two Bluetooth L2CAP flows can cause a use-after-free in l2cap_rx_state_recv (kernel 5.19.8). Specifically, an SKB queued by l2cap_reassemble_sdu may be freed by bt_sock_recvmsg/sock path, while code still accesses l2cap_ctrl in the SKB CB after l2cap...

CVE-2022-50066

Summary: CVE-2022-50066 affects the Linux kernel’s net/atlantic driver (Aquantia) where the final iteration of a for loop can dereference an out-of-bounds aq_vec entry, causing a UBSAN array-index-out-of-bounds condition. The issue manifests as index 8 being out of range for aq_vec_s *[8] in aq_n...

CVE-2022-50100

CVE-2022-50100 affects the Linux kernel sched/core: Do not requeue a task on a CPU excluded from cpus_mask. The issue arises from a ttwu wakeup optimization that could queue a task on the wrong CPU, triggering an early-boot warning on large machines. The commit c6e7bd7afaeb implements a fix by en...

CVE-2022-50228

CVE-2022-50228 is a Linux kernel vulnerability affecting KVM on x86 with SVM. The issue occurs when userspace can inject an interrupt with GIF=0, which can trigger a kernel BUG (fatal crash) in arch/x86/kvm/svm/svm.c. The provided descriptions explicitly show a kernel BUG at svm_inject_irq and an...

CVE-2023-52510

CVE-2023-52510 affects the Linux kernel's ieee802154 ca8210 driver. The vulnerability is caused by a potential use-after-free when of_clk_add_provider() fails in ca8210_register_ext_clock(), which could lead to double clk_unregister() calls during ca8210_probe/ca8210_remove. The fix removes the f...

CVE-2023-53059

CVE-2023-53059 :Vulnerability in the Linux kernel related to the Cros EC chardev path (platform/chrome) where an ioctl handling could leak kernel page data if a larger insize is provided in struct cros_ec_command when issuing EC host commands. The issue enables an information disclosure (confiden...

CVE-2023-53071

CVE-2023-53071 affects the Linux kernel WiFi driver mt76. The root cause was calling ieee80211_unregister_hw unconditionally when probing a mt7921e PCI card without firmware, which could lead to a NULL pointer dereference on driver removal. The fix ensures mt76_unregister_device is invoked only f...

CVE-2023-53073

CVE-2023-53073 documents a Linux kernel issue in perf/x86/amd/core where the unhandled overflow status bits were not consistently masked when the loop continued after x86_perf_event_set_period() could return 0. This caused a warning and an inconsistency because the 'handled' counter could be incr...

CVE-2023-6200

The CVE describes a race condition in the Linux kernel that allows an unauthenticated attacker on an adjacent network to send ICMPv6 router advertisement packets to achieve arbitrary code execution. The impact is documented as high (C/H/I/A) with an adjacent network location and no user interacti...

CVE-2024-26677

CVE-2024-26677 : In the Linux kernel’s rxrpc implementation, the vulnerability stems from how delayed ACKs were constructed with a reference serial number, making them unsuitable as an RTT reference. The issue has been resolved in the kernel by fixing the construction of delayed ACKs to avoid set...

CVE-2024-26788

CVE-2024-26788 affects Linux kernel’s dmaengine: fsl-qdma. The concrete issue is that qDMA IRQs could be enabled before registers were configured, allowing pending interrupts from the primary kernel to reach the irq handler prematurely and cause a panic. The connected Astra Linux advisory confirm...

CVE-2024-36029

CVE-2024-36029 affects the Linux kernel’s MMC subsystem, specifically the mmc: sdhci-msm driver. The vulnerability arises because the sdhci-msm driver does not set the host->runtime_suspended flag, which protects access to the LED device registered by the generic sdhci code. As a result, acces...

CVE-2024-38637

The CVE-2024-38637 issue affects the Linux kernel, specifically the greybus lights driver. The root cause is that get_channel_from_mode may return null when a channel for the given node is not found, and the code used this return value without validating the pointer in two places. This could lead...

CVE-2024-40947

CVE-2024-40947 - Linux kernel ima vulnerability : The issue arises in the IMA policy path when a call to ima_lsm_copy_rule occurs inside an RCU read-side critical section, which can sleep due to kmalloc(GFP_KERNEL). This can cause synchronize_rcu to return early, potentially breaking RCU protecti...

CVE-2024-40971

The CVE-2024-40971 entries are supported by multiple connected advisories describing a Linux kernel/f2fs issue where the SB_INLINECRYPT flag is cleared in f2fs_remount and later re-set during option parsing. This can cause new files opened during the gap to bypass inlinecrypt, with potential data...

CVE-2024-40981

CVE-2024-40981 – Linux kernel batman-adv : The vulnerability centers on batman-adv’s originator handling in batadv_purge_orig_ref(), where empty buckets can lead to soft lockups (CPU 0 stuck for long periods). The root cause is not publicly disclosed in the provided documents, but the fix is desc...

CVE-2024-42085

CVE-2024-42085 affects the Linux kernel USB DWC3 gadget, where when CONFIG_USB_DWC3_DUAL_ROLE is enabled and the system suspends (e.g., echo mem > /sys/power/state), a deadlock can occur during gadget suspend/resume. The triggering path is dwc3_suspend_common() taking dwc3->lock, then dwc3_...

CVE-2024-42086

CVE-2024-42086 pertains to the Linux kernel iio: chemical: bme680 driver, where overflow could occur in compensate() functions due to bit shifting in internal calculations. The issue affects the kernel’s IIO BME680 support and was fixed by a code patch addressing the overflow paths in compensate(...

CVE-2024-42087

CVE-2024-42087 affects the Linux kernel in the drm/panel/ilitek-ili9881c GPIO reset implementation. The issue arises from using gpiod_set_value() for a GPIO controller that may sleep, which triggers warnings. A fix replaces the non-sleeping call with gpiod_set_value_cansleep(), addressing the war...

CVE-2024-42121

CVE-2024-42121 is a Linux kernel vulnerability affecting the DRM/AMD display path. The issue arises from how msg_id is used as an array index and can be negative (not equal to MOD_HDCP_MESSAGE_ID_INVALID, -1). The root cause is missing validation of msg_id before read/write operations, leading to...

CVE-2024-42157

CVE-2024-42157 affects the Linux kernel (s390/pkey) and is tied to wiping sensitive data on failure. Proposed fix/remediation exists in the kernel, with commits referenced by kernel-stable history (e.g., c44a2151e5d21c66b070a056c26471f30719b575 and related commits) and multiple advisories noting ...

CVE-2024-42273

CVE-2024-42273 affects the Linux kernel f2fs driver. Concrete details show that the flaw arises when CURSEG_ALL_DATA_ATGC is assigned to COMPR_ADDR for a valid blkaddr, in scenarios involving f2fs_io setflags compression, leading to a kernel BUG_ON at fs/f2fs/segment.c:3589. The provided exploit ...

CVE-2024-42282

The CVE refers to the Linux kernel Mediatek driver: a NULL pointer dereference in dummy_net_device handling was addressed by moving the free_netdev() call from mtk_free_dev() to mtk_remove(), ensuring free_netdev() only runs after a successful mtk_probe() and full allocation of eth->dummy_dev....

CVE-2024-42286

CVE-2024-42286 affects the Linux kernel SCSI QLA2XXX driver, where nvme_local_port validation was incorrect. The issue could lead to a NULL pointer dereference and a kernel crash (workqueue qla2xxx, nvme_fc_register_remote). Public docs confirm a resolution via upstream kernel fixes (scsi: qla2xx...

CVE-2024-45007

The CVE-2024-45007 issue affects the Linux kernel component related to xillybus workqueues. Root cause: when a kref is decremented, destroy_workqueue() could be invoked from within a work item that is destroying its own workqueue, an illegal scenario. The documented fix introduces a module-global...

CVE-2024-46798

CVE-2024-46798 (Linux kernel, ASoC: dapm) : A use-after-free in snd_soc_pcm_runtime is triggered during system suspend when snd_pcm_suspend_all() accesses a freed object. The issue was detected with KASAN configurations and occurs because snd_pcm_sync_stop() handles substream.runtime defensively,...

CVE-2024-46847

Mode C The CVE-2024-46847 issue affects the Linux kernel memory-management path for vmalloc/vmap_block. The root cause is that a newly instantiated vbmap_block could be added to the vmap_block_queue xarray before its cpu field was initialised, allowing another CPU walking the xarray to perform an...

CVE-2024-47688

CVE-2024-47688 (Linux kernel) involves a potential null-pointer dereference in driver core during module_add_driver() probing for of-fpga-region. If kasprintf() fails, the exit path’s second sysfs_remove_link() could dereference a NULL driver_name because kernfs_name_hash() calls strlen() on NULL...

CVE-2024-50176

CVE-2024-50176 is tied to the Linux kernel remoteproc k3-r5, where an error path during power-up could violate initialization rules and cause a core mismatch (first core usable, second not), leading to crashes on shutdown. The connected Nessus entry indicates this vulnerable state has not been pa...

CVE-2024-53092

CVE-2024-53092 affects the Linux kernel virtio_pci subsystem. The admin virtqueue cleanup used vp_dev->vqs[] for its info pointer instead of vp_dev->admin_vq.info, causing a kernel NULL pointer dereference during vp_reset. The fix retrieves the admin vq’s info pointer from vp_dev->admin_...