CVE-2012-4508

CVE-2012-4508 is a race condition in the Linux kernel's ext4 extents handling (fs/ext4/extents.c) that, before version 3.4.16, allows a local unprivileged user to read data from a deleted file by reading an extent that isn’t properly marked uninitialized. The issue is fixed in the 3.4.16 update (...

CVE-2013-6381

CVE-2013-6381 describes a buffer overflow in the Linux kernel’s qeth_snmp_command function (drivers/s390/net/qeth_core_main.c) up to version 3.12.1, allowing local users to cause a denial of service (and potentially other impact) via an SNMP ioctl with an incompatible length. Connected documents ...

CVE-2014-2568

Use-after-free in Linux kernel: nfqnl_zcopy in nfnetlink_queue_core.c (up to 3.13.6) can leak kernel memory by exploiting missing orphaning; code later moved to skb_zerocopy before the vulnerability was announced. Affected component is the kernel’s net/netfilter/nfnetlink_queue_core.c path; explo...

CVE-2014-4027

CVE-2014-4027 affects the Linux kernel prior to 3.14. The flaw is in the rd_build_device_space function (drivers/target/target_core_rd.c), where a data structure is not properly initialized, enabling local users to read sensitive information from ramdisk_mcp memory by abusing access to a SCSI ini...

CVE-2014-4667

CVE-2014-4667 affects the Linux kernel: the sctp_association_free function in net/sctp/associola.c before version 3.15.2 fails to properly manage a specific backlog value, enabling remote attackers to trigger a denial of service (socket outage) via a crafted SCTP packet. The vulnerability is root...

CVE-2014-9730

CVE-2014-9730 affects the Linux kernel’s UDF support. The function udf_pc_to_char in fs/udf/symlink.c relies on unused component lengths, enabling a local attacker to trigger a denial of service (system crash) by mounting a crafted UDF image. The vulnerability is fixed in kernel 3.18.2 (see Chang...

CVE-2015-4002

CVE-2015-4002 affects the OZWPAN driver in the Linux kernel (drivers/staging/ozwpan/ozusbsvc1.c) up to version 4.0.5. The issue is a length-value handling flaw where certain length values are not sufficiently large, enabling remote attackers to cause a denial of service (system crash or large loo...

CVE-2015-5257

Affected software: Linux kernel before 4.2.4. Vulnerable component: drivers/usb/serial/whiteheat.c. Root cause: crafted USB device triggers a NULL pointer dereference in the WhiteHEAT USB serial driver, leading to denial of service (OOPS) on a physically proximate attacker. Impact: local DoS with...

CVE-2016-6130

CVE-2016-6130 is a race condition in the Linux kernel's sclp_ctl_ioctl_sccb path (drivers/s390/char/sclp_ctl.c) prior to 4.6 that can allow local users to disclose kernel memory by altering a length field (double fetch). The vulnerability is described as a local information-disclosure due to memo...

CVE-2017-17856

CVE-2017-17856 affects the Linux kernel kernel/bpf/verifier.c up to version 4.14.8. It enables local users to cause a denial of service via memory corruption due to lack of stack-pointer alignment enforcement. The provided documents do not include exploitation details or a remediation patch/versi...

CVE-2018-7273

CVE-2018-7273 affects the Linux kernel floppy driver. The show_floppy path in drivers/block/floppy.c prints kernel addresses via printk, enabling local attackers to read addresses from dmesg and locate kernel code/data, potentially bypassing KASLR. The vulnerability is described for Linux kernels...

CVE-2020-36783

CVE-2020-36783 is a Linux kernel I2C (img-scb) reference-count leak issue: pm_runtime_get_sync increments the PM reference count even on failure in img_i2c_xfer and img_i2c_init, leading to leaks. The fix replaces that return path with pm_runtime_resume_and_get to keep the usage counter balanced....

CVE-2021-46994

CVE-2021-46994 concerns the Linux kernel, specifically the can: mcp251x CAN driver. The vulnerability arises when resuming from suspend: since commit 8ce8c0abcba3, the driver queues work via priv->restart_work even if the interface was not previously enabled. This can lead to a NULL pointer de...

CVE-2021-47010

CVE-2021-47010 is a Linux kernel issue affecting the global tcp congestion control default when set from the init netns. The root cause is that tcp_set_default_congestion_control() writes to net.ipv4.tcp_congestion_control in a non-namespaced way and toggles TCP_CONG_NON_RESTRICTED, changing the ...

CVE-2021-47077

CVE-2021-47077 affects the Linux kernel scsi qedf driver. The vulnerability stems from qedf_update_link_speed() dereferencing shost_data when it has not been initialised, causing a NULL pointer dereference and potentially an impact on availability. The fix adds a NULL pointer check before using s...

CVE-2021-47172

CVE-2021-47172 concerns the Linux kernel iio: adc: ad7124 driver. The vulnerability is a potential overflow caused by non sequential channel numbering (holes in channel indices) which can overflow the storage used for channel data. The bug was introduced while addressing ordering of child nodes a...

CVE-2021-47291

CVE-2021-47291 corresponds to a Linux kernel vulnerability where a slab-out-of-bounds occurs in ipv6 fib6_nh_flush_exceptions during KASAN-self-test scenarios. The issue is tied to the handling/initialization of fib6_metrics when an nh is provided, and the fix mirrors an earlier patch by explicit...

CVE-2021-47344

CVE-2021-47344 affects the Linux kernel zr364xx USB video driver. The issue is a memory leak in the zr364xx_start_readpipe path caused by not freeing a URB when usb_submit_urb() fails, leading to leaked memory in non-freed URBs during driver probe/initialization. The description and backtrace in ...

CVE-2021-47438

The CVE concerns the Linux kernel mlx5e driver: net/mlx5e memory leak in mlx5_core_destroy_cq() when an error path occurs. A patch fixes the destroy flow to ensure all cleanup steps run before returning an error, and relocates mlx5_debug_cq_remove() to the start of mlx5_core_destroy_cq() to mirro...

CVE-2022-2308

CVE-2022-2308 describes a vulnerability in the Linux kernel’s vDPA with the VDUSE backend. The VDUSE kernel driver does not validate that the device config space size matches the features advertised by the VDUSE userspace app, causing Virtio config read helpers to pass uninitialized memory to vdu...

CVE-2022-48688

CVE-2022-48688 covers a Linux kernel i40e driver issue where removing modules after an offline ethtool test could crash the kernel. The root cause reported is that the driver frees the client instance incorrectly; during recursive removal (e.g., irdma removing i40e), i40e_lan_del_device dereferen...

CVE-2022-48699

The CVE-2022-48699 issue affects the Linux kernel sched/debug path, where a dentry is leaked by using debugfs_remove(debugfs_lookup()) in update_sched_domain_debugfs. The root cause is improper dentry reference counting, which can, under hotplug stress, lead to memory exhaustion. The available fi...

CVE-2022-48842

CVE-2022-48842 describes a race in the Linux kernel ice driver during interface enslave (bonding). The vulnerability occurs when an auxiliary device is re-created: ice_plug_aux_dev() is invoked from ice_service_task() context, potentially creating an aux device while another thread holds RTNL loc...

CVE-2022-49023

CVE-2022-49023 affects the Linux kernel wifi cfg80211 code; it is a buffer-overflow in vendor element handling where code assumed 5 octets without length validation. The fix involves checking the element length before processing. The vulnerability is described in Unity Linux UTSA advisories (kern...

CVE-2022-49281

CVE-2022-49281 affects Linux kernel CIFS multiuser handling: each user has a separate tcon and handle for a cached directory, but on unmount the kernel must release the pinned dentry for every tcon rather than only the master tcon. If not, unmount can emit warnings of in-use dentries. The issue i...

CVE-2022-49307

CVE-2022-49307 : In the Linux kernel, the tty synclink_gt driver can trigger a null-pointer dereference in slgt_clean() when alloc_hdlcdev() fails and the module is removed. Affected component: the synclink_gt (tty) HDLC driver path in the kernel. The root cause is a null dereference of info->...

CVE-2022-49414

CVE-2022-49414 affects the Linux kernel/ext4: a race between ext4_write and ext4_convert_inline_data can trigger a BUG_ON in ext4_jbd2, potentially leading to filesystem corruption (example trace in Unity/OpenVAS advisories). The public documents identify the issue and describe the underlying cau...

CVE-2022-49669

CVE-2022-49669 concerns the Linux kernel’s MPTCP implementation. A race occurs when the listener socket closes and frees unaccepted subflows, potentially allowing a UaF as the MPTCP socket worker runs between delete operations and accesses msk->first. The fix entails traversing the listener so...

CVE-2022-50053

CVE-2022-50053 concerns the Linux kernel iavf driver: a reset error handling path could lead to deadlock due to double napi_disable and a stuck iavf_remove when VF removal occurs during rapid resets. The fix removes the call to iavf_close in reset error handling and instead calls iavf_disable_vf ...

CVE-2023-23001

CVE-2023-23001 affects Linux kernel prior to 5.16.3, where a misinterpretation of regulator_get’s return value in drivers/scsi/ufs/ufs-mediatek.c treats an error pointer as NULL in the error case. This may lead to improper handling in that path. The vulnerability is addressed by the Linux kernel ...

CVE-2023-3108

CVE-2023-3108 affects the Linux kernel, specifically the get_user_pages_fast path in the skcipher_recvmsg interface for symmetric-key ciphers (crypto/algif_skcipher.c). The flaw allows a local user to crash the system. Public details in the provided documents confirm the vulnerable component and ...

CVE-2023-3389

CVE-2023-3389 (Linux kernel io_uring UAF) : A use-after-free in the io_uring subsystem can be exploited to achieve local privilege escalation. The issue involves racing a io_uring cancel poll request with a linked timeout, which can trigger a UAF in an hrtimer. Impact is local privilege escalatio...

CVE-2023-38430

The CVE-2023-38430 issue affects the ksmbd SMB server in the Linux kernel and is caused by insufficient validation of the SMB request protocol ID, leading to an out-of-bounds read in kernels before 6.3.9. The vulnerability is documented across multiple feeds (Ubuntu USNs and Nessus/OpenVAS adviso...

CVE-2023-52590

CVE-2023-52590 affects the Linux kernel OCFS2 rename path. The issue arises when renaming a directory where the parent does not change; the VFS could lock-touch the renamed directory, risking filesystem corruption. The fix ensures ocfs2 rename code avoids touching a renamed directory if its paren...

CVE-2023-52904

CVE-2023-52904 refers to a Linux kernel ALSA usb-audio vulnerability where snd_usb_pcm_has_fixed_rate() can dereference a NULL subs function argument. The root cause is using the subs argument before a NULL check, leading to an eventual NULL pointer dereference. Exploitation context is local (per...

CVE-2023-52976

CVE-2023-52976 – Linux kernel : The vulnerability occurs in efi_mem_reserve_persistent when dereferencing the result of memremap while iterating a linked list, if memremap returns NULL. The patch adds a NULL check and falls back to allocating a new page when memremap fails, mitigating potential N...

CVE-2024-26684

CVE-2024-26684 relates to the Linux kernel net/stmmac/xgmac path. The root cause is unhandled Data Path Parity Errors (DPP) for DMA channels, which can trigger a storm of interrupts. The fix, per the connected sources, is to check and clear the DMA_DPP_Interrupt_Status register for each channel. ...

CVE-2024-26749

CVE-2024-26749 concerns the Linux kernel USB CDNS3 gadget path. The issue was a memory-use-after-free in cdns3_gadget_ep_disable(), where priv_req is freed via cdns3_gadget_ep_free_request() but list_del_init(&priv_req->list) used priv_req->list after it had been freed, triggering a use-aft...

CVE-2024-35825

Summary (CVE-2024-35825) : The issue in the Linux kernel USB gadget for CDC NCM NTB handling occurs when a zero wBlockLength is encountered. The code’s previous logic could repeatedly process the same NTB if block length is zero, risking a crash. The connected Astra Linux advisory confirms this v...

CVE-2024-35972

The CVE refers to a Linux kernel memory-leak in bnxt_en during bnxt_rdma_aux_device_init(), triggered when ulp = kzalloc() fails and the edev is not assigned to the cleanup path. The fix assigns the allocated edev immediately after kzalloc(), preventing leaks on error paths. Impact is memory leak...

CVE-2024-36021

CVE-2024-36021 affects the Linux kernel net driver for hns3, causing a kernel crash when a devlink reload occurs during PF initialization. The root cause is devlink reload accessing hardware resources before the hardware is initialized. A patch fixes this by taking devl_lock during initialization...

CVE-2024-41074

Technical details for CVE-2024-41074 are not publicly available in the provided documents. Monitor for updates from vendors and security advisories.

CVE-2024-42306

CVE-2024-42306 – Linux kernel UDF vulnerability : The issue arises when a corrupted filesystem block bitmap can be inconsistently used for allocations due to bitmap buffer loading state, risking allocation failures or mixed results. The fix adds a BH_verified flag to track bitmap validity, ensuri...

CVE-2024-42309

CVE-2024-42309 affects the Linux kernel (drm/gma500, psb_intel_lvds_get_modes). Root cause: drm_mode_duplicate() may fail and return NULL, risking a NULL pointer dereference. Fix: added a check to avoid NP Dereference. Impact: NULL pointer dereference could lead to a kernel crash; exploitation de...

CVE-2024-46760

CVE-2024-46760 concerns the Linux kernel wifi driver rtw88 (usb) where RX status handling could dereference a NULL pointer if USB replies arrive before the device is fully initialized. The root cause is initiation of USB REQs (usb_submit_urb) before rtw_dev setup completes, allowing races with in...

CVE-2024-46811

CVE-2024-46811 affects the Linux kernel in the DRM/AMD display component. A potential out-of-bounds condition arises when accessing bw_params->clk_table.entries (8 entries) if soc.num_states can reach 40; the issue is fixed by asserting when soc.num_states exceeds 8 during fpu_update_bw_boundi...

CVE-2024-47746

CVE-2024-47746 affects the Linux kernel fuse subsystem. The issue arises when FUSE_I_CACHE_IO_MODE is set and an exclusive lock is not used, potentially causing fuse_file_cached_io_open to wait indefinitely. The root cause is locking mode for this flag; the fix is to switch to exclusive locking w...

CVE-2024-50011

CVE-2024-50011 is a Linux kernel vulnerability describing an ASoC: Intel soc-acpi-intel-rpl-match issue where an empty item is required in struct snd_soc_acpi_link_adr[]. The root cause is the absence of a links_num and the test !link->num_adr to end the loop in hda_sdw_machine_select(), which...

CVE-2024-50043

CVE-2024-50043 – Linux kernel NFS daemon state-id handling Affected: Linux kernel (nfsd/nfsd4).Cause: In nfsd4_free_stateid(), under the client lock, a delegation stateid is located, but the code drops the lock before calling nfs4_put_stid(). This allows another FREE_STATE to locate the stateid a...

CVE-2024-50176

CVE-2024-50176 is tied to the Linux kernel remoteproc k3-r5, where an error path during power-up could violate initialization rules and cause a core mismatch (first core usable, second not), leading to crashes on shutdown. The connected Nessus entry indicates this vulnerable state has not been pa...