CVE-2014-9710

CVE-2014-9710 affects the Linux kernel’s Btrfs xattr handling prior to 3.19. The vulnerability arises because the visible xattr state may not be consistent with a requested replacement, enabling local attackers to bypass ACLs and gain privileges through standard filesystem operations during an xa...

CVE-2015-4004

The CVE-2015-4004 issue affects the OZWPAN driver in the Linux kernel up to version 4.0.5. The flaw stems from parsing crafted packets using an untrusted length field, allowing remote attackers to read kernel memory (information disclosure) or trigger a denial of service (out-of-bounds read and s...

CVE-2015-8844

CVE-2015-8844 affects the Linux kernel on PowerPC where the signal implementation does not validate an MSR with both the S and T bits set. This can enable a local attacker to cause a denial of service (TM Bad Thing exception and panic) via a crafted application. The vulnerability is fixed in the ...

CVE-2017-17856

CVE-2017-17856 affects the Linux kernel kernel/bpf/verifier.c up to version 4.14.8. It enables local users to cause a denial of service via memory corruption due to lack of stack-pointer alignment enforcement. The provided documents do not include exploitation details or a remediation patch/versi...

CVE-2021-47026

CVE-2021-47026 — Linux kernel (RDMA/rtrs-clt): The issue arises in the rtrs_clt_remove_path_from_sysfs path where, after removing a session from the active list, the code destroys sysfs interfaces. This ordering can allow a use-after-free scenario where concurrent code (e.g., rtrs_clt_request, ge...

CVE-2021-47372

CVE-2021-47372 is a Linux kernel use-after-free in the macb driver. The issue arises from plat_dev->dev->platform_data being released by platform_device_unregister() and subsequently using pclk and hclk, leading to use-after-free in macb_remove. The fixed sequence avoids using the clk devic...

CVE-2022-3112

CVE-2022-3112 affects the Linux kernel up to 5.16-rc6. The issue is in amvdec_set_canvases (drivers/staging/media/meson/vdec/vdec_helpers.c) where kzalloc() return value is not checked, leading to a NULL pointer dereference. Connected sources confirm the same defect across various advisories (e.g...

CVE-2022-48794

CVE-2022-48794 affects the Linux kernel wireless stack for the IEEE 802.15.4 at86rf230 driver. On error, ieee802154_xmit_complete() is not invoked and skb structures are leaked after manual wake_queue() calls in Tx paths. The fix described in the sources is to free the skb upon error before retur...

CVE-2022-48962

CVE-2022-48962 affects the Linux kernel net layer via the hisilicon driver code path net: hisilicon: Fix potential use-after-free in hisi_femac_rx(). The skb can be delivered to napi_gro_receive() which may free it; dereferencing the skb after that may trigger a use-after-free. The connected Tena...

CVE-2022-49308

The CVE-2022-49308 entry describes a Linux kernel extcon overflow/NULL dereference vulnerability that could cause an Oops when sysfs state_show() runs before driver data is set. The root cause is extcon device creation occurring before drvdata is initialized, leading to an edev NULL dereference d...

CVE-2022-49315

CVE-2022-49315 concerns a deadlock in the Linux kernel, specifically in the staging driver rtl8192e (rtllib_beacons_stop). The issue arises when rtllib_beacons_stop() holds ieee->beacon_lock while calling del_timer_sync(), while the timer handler (rtllib_send_beacon_cb) needs the same lock, ca...

CVE-2022-49414

CVE-2022-49414 affects the Linux kernel/ext4: a race between ext4_write and ext4_convert_inline_data can trigger a BUG_ON in ext4_jbd2, potentially leading to filesystem corruption (example trace in Unity/OpenVAS advisories). The public documents identify the issue and describe the underlying cau...

CVE-2022-49622

CVE-2022-49622 (Linux kernel) describes a use-after-free risk in nf_tables when verdict is NF_STOLEN in netfilter, where skb freeing may have occurred. The fix prevents illegal skb access by: (1) caching skb->nf_trace in the trace state and refreshing it when verdict != STOLEN; (2) skipping sk...

CVE-2022-49837

The CVE-2022-49837 issue affects the Linux kernel’s BPF subsystem, specifically memory leaks in __check_func_call and related exit handling. The root cause is that, in prepare_func_exit(), the callee is not released in abnormal paths after state->curframe--, so the frame is not fully freed bef...

CVE-2022-49920

The CVE-2022-49920 entry concerns a race in the Linux kernel netfilter nf_tables netlink notifier that can release objects while a transaction context may still reference them. The root cause is a race between the commit release path (invoked via call_rcu and running locklessly) and object remova...

CVE-2022-49923

The CVE affects the Linux kernel nxp-nci path (nfc: nxp-nci: Fix potential memory leak in nxp_nci_send). The root cause is that nxp_nci_send() frees the allocated skb only on nxp_nci_i2c_write() failure; when the write succeeds, nxp_nci_i2c_write() does not free the skb, causing a memory leak. A ...

CVE-2022-50020

CVE-2022-50020 affects the Linux kernel ext4 filesystem: the patch prevents online resizing to an unaligned/partial cluster boundary. The issue could cause the last resize iteration to grow the filesystem by a negative amount, tripping a BUG_ON and leaving the in-memory superblock corrupted. Conn...

CVE-2022-50212

CVE-2022-50212 affects the Linux kernel netfilter nf_tables subsystem. The vulnerability arises when looking up chains by ID without ensuring the chain belongs to the same table; a chain from another table can be linked in, and removing the source table can leave a rule connected to the wrong cha...

CVE-2023-52507

CVE-2023-52507 affects the Linux kernel NFC stack (nfc: nci) where the protocol is validated via a bitmask; the issue arises from an assertion that the requested protocol is below the maximum, preventing a potential shift-out-of-bounds and clarifying errors between undefined vs. unsupported proto...

CVE-2023-52576

CVE-2023-52576 affects the Linux kernel (x86/mm, kexec, ima). The issue was a use-after-free in memblock_isolate_range() caused by calling ima_free_kexec_buffer() after the memblock allocator had been torn down. The fix switches ima_free_kexec_buffer() to memblock_free_late() to avoid the bug. Wi...

CVE-2023-52642

CVE-2023-52642 concerns a Linux kernel issue in the media: rc subsystem where attaching/detaching BPF programs could require write permission, with an auxiliary CAP_NET_ADMIN requirement. The main impact described across multiple advisories is a locally exploitable condition in kernel space that ...

CVE-2023-53042

CVE-2023-53042 : In the Linux kernel, the drm/amd/display component was vulnerable when writing DRR registers (e.g., OTG_V_TOTAL_MIN) in the same frame as a pipe commit, which could cause underflow. The issue has been resolved by preventing DRR from being set on a pipe commit. The available conne...

CVE-2023-53044

The CVE-2023-53044 entry concerns a Linux kernel vulnerability in the dm-stats path. A NULL pointer dereference can occur in dm_stats_cleanup() if alloc_percpu() fails during dm_stats_init(), with the failure not being properly propagated from alloc_precpu() or dm_stats_init() to dm_stats_cleanup...

CVE-2023-53064

Summary (CVE-2023-53064) : In the Linux kernel, the iavf driver could hang during reboot when E810 VF devices were present and ice is used. Root cause: iavf_remove() may be invoked while the adapter state is already __IAVF_REMOVE, causing the reboot/shutdown path to sleep indefinitely. The fix re...

CVE-2023-53094

CVE-2023-53094 affects the Linux kernel tty/serial fsl_lpuart driver. A race can occur when a DMA RX completion finishes during RX DMA shutdown, causing a NULL dereference on sport->dma_rx_desc. The documented fix is to fold del_timer_sync() into lpuart_dma_rx_free() after dmaengine_terminate_...

CVE-2024-35797

CVE-2024-35797 pertains to the Linux kernel, specifically the mm: cachestat path involving two shmem-related bugs that could occur when cachestat runs concurrently with swapping and invalidation. Root causes described in the sources: (1) a poisoned swap entry in the shmem inode’s xarray could lea...

CVE-2024-35940

CVE-2024-35940 affects the Linux kernel. The vulnerability stems from pstore/zone: missing NULL pointer check in psz_kmsg_read after kasprintf() can return NULL on allocation failure. The impact is a potential NULL pointer dereference in kernel code paths involving kasprintf results, with publicl...

CVE-2024-39477

CVE-2024-39477 affects the Linux kernel mm/hugetlb memory-management code. The root cause was that vma_needs_reservation() could return -ENOMEM when allocate_file_region_entries() failed to allocate a file_region for a reservation, causing a splat in __unmap_hugepage_range(). The published fix is...

CVE-2024-39505

CVE-2024-39505 relates to the Linux kernel drm/komeda code where komeda_pipeline_get_state() may return an error-valued pointer. The fix requires checking the pointer for negative or NULL values before dereferencing. The vulnerability impact is STATED as potential denial of service or corruption ...

CVE-2024-42067

CVE-2024-42067 is a Linux kernel vulnerability where, in the BPF/JIT path, set_memory_rox() may fail and leave memory unprotected. The issue arises because the code does not consistently act on the return value of set_memory_rox() and bpf_jit_binary_lock_ro(), allowing a potential protection gap ...

CVE-2024-42117

CVE-2024-42117 affects the Linux kernel DRM/AMD display path. The root cause was that find_disp_cfg_idx_by_plane_id and find_disp_cfg_idx_by_stream_id could return -1 and that value was used as an index, causing overrun/negative-return conditions. The fix is to return a valid positive index or ta...

CVE-2024-42279

CVE-2024-42279 affects the Linux kernel SPI microchip-core driver. The root cause is that when rx_len == 0, the RX FIFO is not emptied in the interrupt handler, allowing a subsequent transfer to read leftover data from the previous transfer. The documented remediation is to use a register that em...

CVE-2024-42296

In CVE-2024-42296, the Linux kernel f2fs subsystem fixes a return value bug in f2fs_convert_inline_inode(). When the device is read-only, the function now returns EROFS instead of zero, preventing a potential panic during writeback of inline inodes. The issue could otherwise trigger a panic in th...

CVE-2024-42306

The CVE-2024-42306 entry describes a Linux kernel issue in the udf filesystem where a corrupted block bitmap could cause mixed allocation results after a failure, due to bitmap state not being consistently re-validated. The fix uses BH_verified to indicate bitmap validity, preventing reuse of a p...

CVE-2024-43876

CVE-2024-43876 affects the Linux kernel PCIe RCAR driver. The issue concerns demoting the WARN() in rcar_pcie_wakeup() to dev_warn_ratelimited() to reduce backtrace verbosity when a PCIe link issue is detected. The advisory explains a scenario with ASM1062 PCIe/SATA controllers where link state t...

CVE-2024-44943

CVE-2024-44943 relates to the Linux kernel mm/gup code where pinning folio in CMA memory during SEV VM startup could trigger a warning due to misusing try_grab_folio in both fast and slow paths. The issue stems from the longterm pinning check causing fallback paths to also fail, producing a kerne...

CVE-2024-46676

CVE-2024-46676 relates to a Linux kernel vulnerability in the NFC subsystem (pn533 driver). The issue occurs when a bad combination of protocol masks is supplied via Netlink (NFC_CMD_START_POLL): if im_protocols is 1 and tm_protocols is 0, the original check in nfc_start_poll() may pass, but afte...

CVE-2024-46732

CVE-2024-46732 affects the Linux kernel DRM/AMD display path. The root cause was failing to assign linear_pitch_alignment in VM environments, which could lead to a divide-by-zero error. The fix is to assign linear_pitch_alignment in VM contexts; multiple stable-kernel commits (c984debc133e and re...

CVE-2024-46760

CVE-2024-46760 concerns the Linux kernel wifi driver rtw88 (usb) where RX status handling could dereference a NULL pointer if USB replies arrive before the device is fully initialized. The root cause is initiation of USB REQs (usb_submit_urb) before rtw_dev setup completes, allowing races with in...

CVE-2024-46845

CVE-2024-46845 (Linux kernel): The timerlat use-after-free occurs when a SIGTERM kills user-space tracing threads, causing an hrtimer to be freed twice during thread shutdown. The documented fix cancels the hrtimer only if the associated thread still exists and adds an interface_lock around tlat_...

CVE-2024-50114

CVE-2024-50114 affects Linux kernel KVM on arm64. The flaw originates in the vCPU teardown path when a failed vCPU creation leads to an MMIO redistributor being unregistered, triggering a use-after-free in kvm_put_kvm during VM teardown. The root cause is improper teardown ordering that could all...

CVE-2024-53083

Technical details for CVE-2024-53083 are not present in the provided connected documents; only a brief kernel description is given. Monitor for updates.

CVE-2024-53107

CVE-2024-53107 affects the Linux kernel in fs/proc/task_mmu.c (pagemap_scan_get_args). The issue is an integer overflow: arg->vec_len is read as a u64 from user space and used in the expression arg->vec_len * sizeof(struct page_region), which can wrap. The fix uses size_mul() to perform the...

CVE-2024-53132

CVE-2024-53132 affects the Linux kernel DRM XE OA subsystem (xe/oa). Root cause: missing outer runtime PM protection leading to a warning and potential mis-handling of runtime power management for xe/oa. Remedy: patch applied in commit b107c63d2953907908fd0cafb0e543b3c3167b75; kernel updates inco...

CVE-2024-57994

CVE-2024-57994 : In the Linux kernel, a bug in ptr_ring_resize_multiple caused a splat when hard interrupts were blocked inside the resize path. The fix removes masking of hard IRQs (now only BHs are blocked) and adds a lockdep_assert_no_hardirq() check in __page_pool_put_page() to improve test c...

CVE-2024-58011

The CVE-2024-58011 entry concerns the Linux kernel, specifically the platform/x86 int3472 driver. The root cause is a missing check for adev against NULL when a device may not have an ACPI companion fwnode, which could allow adev to be NULL and lead to a NULL pointer dereference in skl_int3472_ge...

CVE-2024-58095

CVE-2024-58095 (jfs: add check read-only before txBeginAnon() call) is confirmed as a concrete kernel fix. The patch introduces a read-only check prior to txBeginAnon() in extAlloc and extRecord within the JFS code path. This prevents write attempts on a read-only mounted filesystem, avoiding pot...

CVE-2025-21713

CVE-2025-21713 affects the PowerPC/ pSeries IOMMU path in the Linux kernel. The issue occurs when reusing the same vfio container across different IOMMU groups, where spapr_tce_set_window() may lead to cleanup that dereferences a null or invalid tbl, causing a kernel crash (NULL pointer dereferen...

CVE-2025-21793

CVE-2025-21793 concerns the Linux kernel SPI SN-F-OSPI path. The linked Azure/Linux Nessus entry confirms the issue: when there is no dummy cycle in spi-nor commands, dummy bus cycle bytes and width become zero, risking a divide-by-zero warning. The fix is to return zero to avoid such calculation...

CVE-2025-21972

The connected BDU/FSTEC entry describes a vulnerability in the Linux kernel MCTP implementation, specifically the mctp_frag_queue() function in net/mctp/route.c. It cites improper memory release as the root cause, leading to a memory leak and the potential to cause a service failure. Exploitation...