CVE-2024-43894

CVE-2024-43894 — kernel DRM NULL-deref fix : In the Linux kernel drm/client path, the function drm_client_modeset_probe can dereference a NULL after drm_mode_duplicate() fails because the returned pointer is assigned directly to modeset->mode. The patch adds a safety check to avoid NULL pointe...

CVE-2024-46732

CVE-2024-46732 affects the Linux kernel DRM/AMD display path. The root cause was failing to assign linear_pitch_alignment in VM environments, which could lead to a divide-by-zero error. The fix is to assign linear_pitch_alignment in VM contexts; multiple stable-kernel commits (c984debc133e and re...

CVE-2024-50091

Summary: CVE-2024-50091 affects the Linux kernel driver path for dm-vdo, where the code may examine a dedupe_context pointer after ownership is lost. The vulnerability arises from not clearing the dedupe_context pointer in data_vio when ownership changes, enabling a potential misuse if the pointe...

CVE-2024-50104

Technical details for CVE-2024-50104 are not publicly provided in the supplied documents; monitor for official advisories or patches.

CVE-2024-50114

CVE-2024-50114 affects Linux kernel KVM on arm64. The flaw originates in the vCPU teardown path when a failed vCPU creation leads to an MMIO redistributor being unregistered, triggering a use-after-free in kvm_put_kvm during VM teardown. The root cause is improper teardown ordering that could all...

CVE-2024-50174

CVE-2024-50174 affects the Linux kernel’s panthor DRM path. The issue is a race between retrieving a pointer from an XArray and incrementing its reference count when converting a group handle to a group object. The documented fix is to hold the internal XArray lock while incrementing the referenc...

CVE-2024-53098

CVE-2024-53098 affects the Linux kernel DRM XE ufence path. The root cause is that access_ok() only checks for addr overflow and may also read the user-supplied address to catch invalid addresses, coupled with prefetching ufence addresses to detect bogus ones. The issue is remedied by a kernel fi...

CVE-2024-53107

CVE-2024-53107 affects the Linux kernel in fs/proc/task_mmu.c (pagemap_scan_get_args). The issue is an integer overflow: arg->vec_len is read as a u64 from user space and used in the expression arg->vec_len * sizeof(struct page_region), which can wrap. The fix uses size_mul() to perform the...

CVE-2024-53132

CVE-2024-53132 affects the Linux kernel DRM XE OA subsystem (xe/oa). Root cause: missing outer runtime PM protection leading to a warning and potential mis-handling of runtime power management for xe/oa. Remedy: patch applied in commit b107c63d2953907908fd0cafb0e543b3c3167b75; kernel updates inco...

CVE-2024-53149

Technical details (affected product, root cause, impact, fix) are not publicly provided in the connected documents; monitor for updates.

CVE-2024-58011

The CVE-2024-58011 entry concerns the Linux kernel, specifically the platform/x86 int3472 driver. The root cause is a missing check for adev against NULL when a device may not have an ACPI companion fwnode, which could allow adev to be NULL and lead to a NULL pointer dereference in skl_int3472_ge...

CVE-2024-58057

CVE-2024-58057 is described in connected advisories as a Linux kernel issue where the idpf driver converts workqueues to unbound (WQ_UNBOUND). The root cause is that unbound workqueues allow worker threads to run on any CPU within the same node when no CPU is specified, which can cause large comp...

CVE-2025-21716

CVE-2025-21716 : In the Linux kernel, vxlan_vnifilter_dump() could access bytes beyond a netlink message when the payload length is smaller than sizeof(struct tunnel_msg), potentially causing an uninitialized-value access. The fix is to return an error if the payload is too short. Affected platfo...

CVE-2025-21906

The CVE-2025-21906 issue concerns the Linux kernel wireless stack (iwlwifi/mvm) where ROC cleanup on failure was mishandled. In the failure/stop path, iwl_mvm_roc_finished() could be a no‑op because IWL_MVM_STATUS_ROC_P2P_RUNNING was never set, potentially causing a WARN_ON() on a remain-on-chann...

CVE-2025-22071

CVE-2025-22071 concerns the Linux kernel spufs subsystem. The issue is a leak in spufs_create_context() that occurs when setting CPU affinity and spufs_mkdir() fails, requiring the code to drop the reference to the neighbor. The problem was fixed by this leak remediation, with historical notes th...

CVE-2025-37909

CVE-2025-37909 affects the Linux kernel net: lan743x subsystem. When GSO is enabled and fragments count is zero, skb is mapped to an EXT descriptor, preventing it from being freed and causing a memory leak. The fix maps the skb to the LS descriptor unconditionally, eliminating the memleak. This i...

CVE-2025-37917

The CVE-2025-37917 issue is in the Linux kernel MTK Star EMAC driver (mtk_star_emac). It describes spinlock recursion that can occur when DMA interrupts are re-enabled during rx/tx polling. The documented fix replaces spin_lock/spin_unlock with spin_lock_irqsave/spin_unlock_irqrestore in mtk_star...

CVE-2025-37923

CVE-2025-37923 affects the Linux kernel tracing path. The bug is a slab-out-of-bounds write in trace_seq_to_buffer() that can copy more data than PAGE_SIZE when used by tracing_splice_read_pipe, leading to a local, high-severity impact. The root cause is an out-of-bounds copy in trace_seq_to_buff...

CVE-2025-37935

The CVE-2025-37935 issue affects the Linux kernel driver net: ethernet: mtk_eth_soc, where the mtk_poll_rx() path, upon detecting MTK_RESETTING, jumps to release_desc and refills the SDP high word for 4GB+ RAM, causing mtk_rx_clean to process an invalid SDP and trigger a panic. A fix from MediaTe...

CVE-2025-37944

CVE-2025-37944 affects the Linux kernel wifi stack (ath12k). The root cause is in ath12k_dp_mon_srng_process, which incorrectly uses ath12k_hal_srng_src_get_next_entry to fetch entries from the destination ring. This misapplied function leads to invalid memory access, risking data corruption or c...

CVE-2025-37963

CVE-2025-37963 affects the Linux kernel on arm64 in the BPF subsystem. The vulnerability arises in the mitigation scope for eBPF: only cBPF programs loaded by unprivileged users are mitigated, as support for unprivileged eBPF is typically disabled and privileged users can still load the same prog...

CVE-2025-38445

CVE-2025-38445 covers a Linux kernel issue in md/raid1 where raid1_reshape allocated a mempool on the stack and assigned it to conf->r1bio_pool, causing conf->r1bio_pool.wait.head to reference a stack address. Subsequent access in raid1_read_request/raid1_write_request paths could trigger a...

CVE-2026-46150

The CVE-2026-46150 issue affects the Linux kernel fanotify subsystem. It arises because fsnotify_get_mark_safe() may return false for a mark in an unrelated group, bypassing the permission check. The fix patches the logic to skip detached marks that are not in the current group, mitigating the by...

CVE-2008-5029

CVE-2008-5029 affects the Linux kernel 2.6.27.4, 2.6.26 and earlier via the __scm_destroy function in net/core/scm.c, which can cause indirect recursive calls when closing sockets after an SCM_RIGHTS message. This local DoS (panic) condition results from the kernel’s handling of UNIX domain socke...

CVE-2009-0031

CVE-2009-0031 affects Linux kernel 2.6.29-rc2 and earlier, caused by a memory leak in keyctl_join_session_keyring (security/keys/keyctl.c) that can allow local users to consume kernel memory and trigger a denial of service. Root cause described as a missing kfree. Connected advisories (e.g., RHSA...

CVE-2009-2407

CVE-2009-2407 describes a heap-based buffer overflow in the parse_tag_3_packet function of fs/ecryptfs/keystore.c in the Linux kernel’s eCryptfs subsystem, exploitable via a crafted eCryptfs file. The issue affects Linux kernels before 2.6.30.4 and can lead to a denial of service (system crash) o...

CVE-2010-4165

CVE-2010-4165 affects the Linux kernel prior to 2.6.37-rc2. The do_tcp_setsockopt function does not properly constrain TCP_MAXSEG (MSS) values, allowing a local user to trigger a denial of service via a setsockopt with a small value, leading to a divide-by-zero or signed-integer misuse. Evidence ...

CVE-2012-1097

CVE-2012-1097 affects the Linux kernel before 3.2.10, where the regset (register set) path mishandles absence of .get/.set methods. This can allow a local attacker to trigger a NULL pointer dereference via PTRACE_GETREGSET or PTRACE_SETREGSET, possibly causing denial of service or other impact. R...

CVE-2012-6548

CVE-2012-6548 affects the Linux kernel: the udf_encode_fh function in fs/udf/namei.c does not initialize a structure member in kernels before 3.6, enabling a local user to read sensitive information from kernel heap memory via a crafted application. Several connected advisories (e.g., Red Hat RHS...

CVE-2013-1792

The CVE-2013-1792 entry is valid and has concrete details in connected documents: a race condition in the Linux kernel’s install_user_keyrings() (security/keys/process_keys.c) allows local users to trigger a NULL pointer dereference and crash via concurrent keyctl calls. The vulnerability affects...

CVE-2014-9090

CVE-2014-9090 affects the Linux kernel up to 3.17.4, where do_double_fault in arch/x86/kernel/traps.c mishandles SS fault conditions, allowing local users to cause a denial of service (panic) via modify_ldt (demonstrated by sigreturn_32 in linux-clock-tests). The issue was addressed by a patch li...

CVE-2014-9803

CVE-2014-9803 affects the Linux kernel and Android deployments using affected kernels prior to 3.15-rc5-next-20140519 (notably on Nexus 5X/6P before 2016-07-05). The issue arises in arch/arm64/include/asm/pgtable.h where execute-only pages are mishandled, enabling a local attacker to gain privile...

CVE-2017-10662

The CVE-2017-10662 issue affects the Linux kernel’s F2FS implementation: the sanity_check_raw_super function in fs/f2fs/super.c fails to validate the segment count, enabling local privilege escalation. Concretely, affected versions are before 4.11.1. Several connected advisories (e.g., UTSA/Euler...

CVE-2017-17053

CVE-2017-17053 affects the Linux kernel, specifically the init_new_context code path in arch/x86/include/asm/mmu_context.h, for kernels built with CONFIG_MODIFY_LDT_SYSCALL=y. Before 4.12.10, errors from LDT table allocation when forking a new process are not handled correctly, enabling a local a...

CVE-2018-11508

CVE-2018-11508 affects the Linux kernel’s compat_get_timex implementation in kernel/compat.c, allowing a local attacker to disclose kernel memory via adjtimex, with affected versions up to but before 4.16.9. The issue’s public fixes are documented in ChangeLog-4.16.9 and Ubuntu security advisorie...

CVE-2019-15791

CVE-2019-15791 describes a refcount underflow in the Linux kernel shiftfs implementation caused by a non-upstream patch in Ubuntu 5.0/5.3 kernels: shiftfs_btrfs_ioctl_fd_replace() can create a file descriptor to a lower-filesystem file without an extra reference, and closing the FD after the btrf...

CVE-2021-20219

CVE-2021-20219: Linux kernel DoS in n_tty_receive_char_special (drivers/tty/n_tty.c). Local attacker with unprivileged user can delay the loop (ldata->read_head changes) due to a missing sanity check, impacting availability. The initial doc does not specify affected kernel versions, patches, o...

CVE-2021-46982

CVE-2021-46982 relates to the Linux kernel’s f2fs compress path. A race between truncate and overwrite can leave a reference on a page, causing find_lock_page to return NULL after truncation. Root cause involves prepare_compress_overwrite, f2fs_pagecache_get_page, and subsequent truncate_setsize/...

CVE-2021-47057

In the Linux kernel, the following vulnerability has been resolved: crypto: sun8i-ss - Fix memory leak of object d when dma_iv fails to map In the case where the dma_iv mapping fails, the return error path leaksthe memory allocated to object d. Fix this by adding a new error returnlabel and jumpi...

CVE-2021-47070

In the Linux kernel, the following vulnerability has been resolved: uio_hv_generic: Fix another memory leak in error handling paths Memory allocated by 'vmbus_alloc_ring()' at the beginning of the probefunction is never freed in the error handling path. Add the missing 'vmbus_free_ring()' call. N...

CVE-2021-47126

CVE-2021-47126 is a Linux kernel IPv6 KASAN slab-out-of-bounds read vulnerability in net/ipv6/route.c (fib6_nh_flush_exceptions). The issue involved reads of 8 bytes in fib6_nh_get_excptn_bucket, leading to a slab-out-of-bounds access traced to fib6_nh_flush_exceptions and related calls. The defe...

CVE-2021-47344

CVE-2021-47344 affects the Linux kernel zr364xx USB video driver. The issue is a memory leak in the zr364xx_start_readpipe path caused by not freeing a URB when usb_submit_urb() fails, leading to leaked memory in non-freed URBs during driver probe/initialization. The description and backtrace in ...

CVE-2021-47443

The Linux kernel contains a memory leak vulnerability in the NFC subsystem within the digital_tg_listen_mdaa() function. The issue is caused by the 'params' variable being allocated but not freed if the digital_send_cmd() function fails. This lack of memory release can lead to a service failure ....

CVE-2021-47534

In the Linux kernel, the following vulnerability has been resolved: drm/vc4: kms: Add missing drm_crtc_commit_put Commit 9ec03d7f1ed3 ("drm/vc4: kms: Wait on previous FIFO users before acommit") introduced a global state for the HVS, with each FIFO storingthe current CRTC commit so that we can pr...

CVE-2022-3078

CVE-2022-3078 affects Linux kernels up to 5.16-rc6; it arises from a lack of a post-allocation check after vzalloc() and a missing free in drivers/media/test-drivers/vidtv/vidtv_s302m.c. This can enable memory mismanagement within the affected driver. A fix is available in kernel patch history (e...

CVE-2022-3112

CVE-2022-3112 affects the Linux kernel up to 5.16-rc6. The issue is in amvdec_set_canvases (drivers/staging/media/meson/vdec/vdec_helpers.c) where kzalloc() return value is not checked, leading to a NULL pointer dereference. Connected sources confirm the same defect across various advisories (e.g...

CVE-2022-47938

Technical details are not publicly provided in the supplied documents. CVE-2022-47938 concerns ksmbd in the Linux kernel 5.15–5.19 before 5.19.2, with an out-of-bounds read during SMB2_TREE_CONNECT; monitor for updates.

CVE-2022-48630

CVE-2022-48630 affects the Linux kernel crypto: qcom-rng. The issue is an infinite loop in qcom_rng_read() when max is not a multiple of WORD_SZ, caused by removing a break in the else branch. The fix re-adds the break (a simple patch) to avoid looping. The vulnerability was demonstrated/tested o...

CVE-2022-49002

The CVE-2022-49002 issue is in the Linux kernel’s IOMMU VT-d path. The for_each_pci_dev() loop relies on pci_get_device(), which increments the PCI device refcount, but an error path lacked a corresponding pci_dev_put(), leading to a potential reference-count leak. The fix adds pci_dev_put() in t...

CVE-2022-49188

CVE-2022-49188 affects the Linux kernel remoteproc: qcom_q6v5_mss path, where leaks can occur in q6v5_alloc_memory_region due to improper device_node handling. The root cause is that the device_node pointer returned by of_parse_phandle() or of_get_child_by_name() is not always balanced with of_no...