CVE-2024-50176

CVE-2024-50176 is tied to the Linux kernel remoteproc k3-r5, where an error path during power-up could violate initialization rules and cause a core mismatch (first core usable, second not), leading to crashes on shutdown. The connected Nessus entry indicates this vulnerable state has not been pa...

CVE-2024-50297

CVE-2024-50297 affects the Linux kernel Xilinx AXI Ethernet driver (net: xilinx: axienet). A race occurs when Tx packets are enqueued in the dynamic queue limits (dql) before the DMA engine starts; when the DMA starts, a dql dequeue can execute before the packet is queued, causing a kernel crash ...

CVE-2024-56537

Technical details for CVE-2024-56537 are not publicly available in the provided documents. No vendor/product specifics or remediation are given here. Monitor for official advisories and patch notes for affected kernel components.

CVE-2024-56652

The Linux kernel vulnerability CVE-2024-56652 affects drm/xe reg_sr pool logic. A faulty register pool implementation can lead to use-after-free when krealloc moves memory, leaving xarray entries invalid and causing a use-after-free in xe_reg_sr_apply_mmio. The issue arises because memory relocat...

CVE-2024-56657

CVE-2024-56657 relates to the Linux kernel ALSA: control path where WARN() was used for symlink creation errors. The fix downgrades these warnings to dev_err() and adds the function name to the prefix to reduce confusion (notably for fuzzers). This is a patch-level remediation described in Azure ...

CVE-2024-56697

CVE-2024-56697 affects the Linux kernel DRM/AMDGPU path. The issue was a memory allocation problem in amdgpu_discovery_get_nps_info() (mem_ranges) that could dereference a NULL pointer. The fix adds a failure check, switches to kvcalloc() to guard against integer overflow, and assigns output para...

CVE-2024-58088

In CVE-2024-58088, the Linux kernel’s BPF cgroup storage path could deadlock when freeing storage. The issue stemmed from passing NULL to bpf_local_storage_map_free() in cgrp storage, creating a locking window. Affected components include tasks attaching fentry/fexit programs and non-cgroup-attac...

CVE-2025-21706

CVE-2025-21706 is a Linux kernel vulnerability in the MPTCP path-manager. The in-kernel path-manager’s netlink set_flags path allowed non-subflow endpoints to receive the fullmesh flag due to a permissive hook, enabling an issue observed by syzbot warnings in net/mptcp/pm_netlink.c. The root caus...

CVE-2025-21716

CVE-2025-21716 : In the Linux kernel, vxlan_vnifilter_dump() could access bytes beyond a netlink message when the payload length is smaller than sizeof(struct tunnel_msg), potentially causing an uninitialized-value access. The fix is to return an error if the payload is too short. Affected platfo...

CVE-2025-21737

CVE-2025-21737: Linux kernel memory-leak in ceph_mds_auth_match fixed by freeing the temporary target path substring allocation on all branches; leak could trigger memory growth and kernel OOM. Connected docs corroborate the fix in ceph_mds_auth_match and the impact described in production. No ad...

CVE-2025-21773

CVE-2025-21773 affects the Linux kernel driver can: etas_es58x. The root cause is a potential NULL pointer dereference when es58x_dev->udev->serial is NULL; the driver previously assumed serial could never be NULL. A patch adds a check for es58x_dev->udev->serial before dereferencing ...

CVE-2025-21960

CVE-2025-21960 is addressed in the TencentOS Server 4 kernel advisory (TSSA-2025:0348). The issue is in nbd reconnect handling after disconnect, potentially enabling a use-after-free via recv_work when nbd_config is freed. The advisory states the root cause: in nbd_genl_disconnect(), NBD_RT_BOUND...

CVE-2025-22003

CVE-2025-22003 (Linux kernel, can: ucan): A one-byte out-of-bounds read was introduced in the can: ucan path due to a mismatch when using strscpy() with a length of len+1. The issue arises because strscpy() reads len+1 bytes from the source to detect truncation, even when the source is not NULL-t...

CVE-2025-22068

The CVE-2025-22068 issue affects the Linux kernel ublk (userspace block driver). Root cause: ubq->canceling was not reliably observed when the queue froze, which could lead to improper dispatch decisions in uring_cmd and io_uring_cmd_complete_in_task(). The patch makes ubq->canceling be set...

CVE-2025-22117

CVE-2025-22117 affects the Linux kernel ice driver (ice_vc_fdir_parse_raw in ice_virtchnl_fdir.c). The vulnerability arises from using an untrusted value of pkt_len, fixed by verifying pkt_len does not exceed VIRTCHNL_MAX_SIZE_RAW_PACKET in ice_vc_fdir_parse_raw(). Connected advisories (Debian, O...

CVE-2025-37990

CVE-2025-37990 affects the Linux kernel’s wifi/brcm80211 fmac, where brcmf_usb_dl_writeimage() did not validate the return value of brcmf_usb_dl_cmd(), leaving state.state and state.bytes uninitialized if the call failed. The fix adds error handling to jump to the error path when brcmf_usb_dl_cmd...

CVE-2025-38079

The CVE-2025-38079 entry concerns a vulnerability in the Linux kernel crypto/algif_hash: a double free in hash_accept when accept(2) is used on an algif_hash socket with MSG_MORE and crypto_ahash_import fails. This leads to a slab-use-after-free due to sk2 being freed in both hash_accept and af_a...

CVE-2026-31419

Summary of CVE-2026-31419 : A use-after-free in the Linux kernel bonding driver is caused by a race in bond_xmit_broadcast() where the last slave determination can change during RCUs, leading to double-free of the original skb and a potential crash. The fix replaces the racy bond_is_last_slave() ...

CVE-2007-3380

The CVE-2007-3380 vulnerability affects the Linux kernel 2.6.15 Distributed Lock Manager (DLM). A remote attacker who can connect to the DLM port can cause a denial of service, potentially blocking DLM operations and affecting lock services. Connected advisories (RHSA-2007:0940, RHBA-2007:0861, E...

CVE-2008-0007

CVE-2008-0007 affects the Linux kernel prior to 2.6.22.17. Certain drivers register a fault handler that does not perform proper range checks, allowing a local attacker to access kernel memory via an out-of-range offset. The MiracleLinux/Nessus entry confirms the issue and lists affected kernel v...

CVE-2008-4210

CVE-2008-4210 affects the Linux kernel prior to 2.6.22. fs/open.c does not properly strip setuid/setgid bits on writes, allowing local users to gain privileges of a different group and access sensitive information by creating an executable file in a setgid directory via truncate/ftruncate with me...

CVE-2009-3939

CVE-2009-3939 affects the Linux kernel megaraid_sas driver: the poll_mode_io file has world-writable permissions in kernel 2.6.31.6 and earlier. This enables local users to change the driver I/O mode by modifying the file. The description notes local access and manipulation of driver behavior, wi...

CVE-2010-2954

The CVE-2010-2954 issue affects the Linux kernel IRDA stack: irda_bind in net/irda/af_irda.c may dereference a NULL pointer when irda_open_tsap fails, causing local denial of service (kernel panic) via repeated unsuccessful binds on AF_IRDA (PF_IRDA) sockets. Affected software is the Linux kernel...

CVE-2010-3066

The CVE-2010-3066 issue affects the Linux kernel (fs/aio.c: io_submit_one) in versions prior to 2.6.23. A crafted io_submit call with IOCB_FLAG_RESFD can trigger a NULL pointer dereference, allowing a local user to cause a denial of service. The problem is rooted in the asynchronous I/O path (io_...

CVE-2010-3874

CVE-2010-3874: Heap-based buffer overflow in the bcm_connect function of net/can/bcm.c (Broadcast Manager) in the Linux kernel CAN implementation. Affects 64-bit kernels, before 2.6.36.2, enabling local attackers to cause memory corruption and a denial of service via a connect operation. The conn...

CVE-2010-4169

CVE-2010-4169 is a Linux kernel use-after-free in mm/mprotect.c, vulnerable before 2.6.37-rc2. Local users can trigger a denial of service via an mprotect syscall. The MiracleLinux advisory AXSA:2011-80:02 confirms the issue among kernel fixes; remediation is to upgrade to kernel 2.6.37-rc2 or ne...

CVE-2010-4527

The CVE-2010-4527 entry concerns the Linux kernel OSS sound driver (load_mixer_volumes in sound/oss/soundcard.c). It arises because a name field is not guaranteed to end with a NUL, enabling a local user to trigger a buffer overflow via SOUND_MIXER_SETLEVELS, with potential to escalate privileges...

CVE-2011-1478

CVE-2011-1478 affects the Linux kernel’s GRO napi_reuse_skb path: it does not reset certain structure members in net/core/dev.c, enabling a remote attacker to trigger a NULL pointer dereference via a malformed VLAN frame and cause a denial of service. The vulnerability is present in kernels befor...

CVE-2013-1819

CVE-2013-1819 affects the Linux kernel prior to 3.7.6. The vulnerability resides in fs/xfs/xfs_buf.c: _xfs_buf_find does not validate block numbers, which can allow local users to mount an XFS filesystem with an invalid extent map and trigger a NULL pointer dereference, causing a denial of servic...

CVE-2013-2015

The vulnerability CVE-2013-2015 affects the Linux kernel’s ext4 implementation. Specifically, ext4/namei.c: the function ext4_orphan_del mishandles orphan-list entries for non-journal filesystems, allowing physically proximate attackers to cause a denial of service (system hang) by presenting a c...

CVE-2013-7264

The CVE-2013-7264 issue affects the Linux kernel up to version 3.12.3, specifically the l2tp_ip_recvmsg function in net/l2tp/l2tp_ip.c. The vulnerability arises because a length value is updated before ensuring that the associated data structure is initialized, enabling a local attacker to leak k...

CVE-2014-0206

CVE-2014-0206 is an array index error in aio_read_events_ring (fs/aio.c) of the Linux kernel up to version 3.15.1. It enables local users to read sensitive data from kernel memory by supplying a large head value. The provided connected documents confirm the affected file and vulnerability type bu...

CVE-2014-3940

CVE-2014-3940 affects the Linux kernel up to version 3.14.5, where hugetlb handling during hugepage migration can enable local users to trigger a race condition that may lead to memory corruption or a system crash. The issue is tied to the code paths in fs/proc/task_mmu.c and mm/mempolicy.c and i...

CVE-2015-4170

CVE-2015-4170 describes a race condition in the Linux kernel’s tty shutdown path: in ldsem_cmpxchg() within drivers/tty/tty_ldsem.c, allowing a local user to trigger a deadlock (ldsem_down_read/ldsem_down_write) by starting a new tty thread during shutdown of a previous one. The affected codebase...

CVE-2016-2546

CVE-2016-2546 : In the Linux kernel, sound/core/timer.c uses an incorrect mutex type, enabling local attackers to trigger a denial of service via a crafted ioctl. Root cause is a mutex type misusage that can cause race conditions and use-after-free leading to system crashes. Affected function/fil...

CVE-2017-16534

CVE-2017-16534 affects the Linux kernel before 4.13.6, specifically the cdc_parse_cdc_header function in drivers/usb/core/message.c. A crafted USB device can trigger an out-of-bounds read, causing a local denial of service (system crash) and potentially other impact. The advisory notes this is a ...

CVE-2018-12930

CVE-2018-12930 targets the ntfs_end_buffer_async_read function in the ntfs.ko driver of Linux kernel 4.15.0. A crafted NTFS filesystem can trigger a stack-based out-of-bounds write, leading to a denial of service (kernel oops or panic) and possibly unspecified other impacts. The connected documen...

CVE-2021-3714

CVE-2021-3714 (Linux kernel) affects the kernel’s memory deduplication mechanism. The connected sources describe a local-exploitation style attack where an adversary can upload page-sized files and observe access-time changes from a networked service to infer whether pages have been merged. This ...

CVE-2021-47045

CVE-2021-47045 affects Linux kernel SCSI lpfc (lpfc_prep_els_iocb). The vulnerability arises when lpfc_issue_els_plogi() is called with a did that has no matching ndlp, causing a NULL pointer dereference to lpfc_nodelist. The fix returns an error status if no valid ndlp is found and updates ndlp ...

CVE-2021-47465

CVE-2021-47465 is a Linux kernel vulnerability affecting the PPC Book3S HV emergency stack handling. The issue occurred in idle_kvm_start_guest(), where the previous approach stored CR/LR and stack frames on the emergency stack without ensuring a valid frame boundary, causing writes outside the e...

CVE-2021-47520

Summary (CVE-2021-47520): A Linux kernel issue in can: pch_can: pch_can_rx_normal leads to a use-after-free when dereferencing skb after netif_receive_skb(skb); the can_frame cf aliases skb memory and is dereferenced immediately after. The documented fix is a reordering of lines to prevent derefe...

CVE-2021-47594

The CVE-2021-47594 entry is a legitimate Linux kernel vulnerability. It describes that the PM could close MPTCP listener subflows when deleting an endpoint, potentially affecting listener sockets bound to the endpoint IP and risking a NULL pointer dereference reported by syzbot. The connected doc...

CVE-2021-47599

CVE-2021-47599 covers a Linux kernel bug in btrfs: during pruning/moving devices, btrfs_show_devname() could fail to find devices and emit a warning. The fix updates the device list handling so latest_dev->name is shown reliably in /proc/self/mounts, with devices kept alive under RCU protectio...

CVE-2022-48425

CVE-2022-48425 affects the Linux kernel up to 6.2.7, specifically the NTFS3 inode.c path. The issue is an invalid kfree introduced by not validating MFT flags before replaying logs, as described in the initial CVE entry. Consequences are consistent with the CVSS high scores listed in the document...

CVE-2022-48841

Vulnerability CVE-2022-48841 affects the Linux kernel ice driver: NULL pointer dereference in ice_update_vsi_tx_ring_stats() during Tx ring stats update. If the ring pointer is NULL, a later access to propagate Tx stats to VSI stats could crash. The fix changes logic to move to the next ring when...

CVE-2022-48879

CVE-2022-48879 concerns a Linux kernel vulnerability within the EFI/Runtime Services path. The issue arises when runtime services are not supported or disabled, causing the runtime services workqueue to never be allocated, which could lead to a NULL pointer dereference if the code attempts to des...

CVE-2022-49182

CVE-2022-49182 affects the Linux kernel net/hns3 VLAN handling. The vulnerability occurs when adding port base VLAN: removing the VF VLAN from HW and updating the VF VLAN list can lead to a use-after-free if the periodic task frees the same node. The patch adds a vlan list lock to protect the VLA...

CVE-2022-49837

The CVE-2022-49837 issue affects the Linux kernel’s BPF subsystem, specifically memory leaks in __check_func_call and related exit handling. The root cause is that, in prepare_func_exit(), the callee is not released in abnormal paths after state->curframe--, so the frame is not fully freed bef...

CVE-2023-20848

The CVE-2023-20848 entry concerns an out-of-bounds read in imgsys_cmdq caused by missing valid range checking, enabling local escalation of privileges with user interaction required. Documented impact is high for confidentiality/integrity/availability, and a patch ID (ALPS07340433) is noted as th...

CVE-2023-3357

CVE-2023-3357 describes a NULL pointer dereference in the Linux kernel AMD Sensor Fusion Hub driver. This vulnerability can be exploited by a local user to crash the system (local impact). Connected sources indicate a patched kernel is available; e.g., SUSE advisories note kernel updates for affe...