CVE-2024-42157

CVE-2024-42157 affects the Linux kernel (s390/pkey) and is tied to wiping sensitive data on failure. Proposed fix/remediation exists in the kernel, with commits referenced by kernel-stable history (e.g., c44a2151e5d21c66b070a056c26471f30719b575 and related commits) and multiple advisories noting ...

CVE-2013-2893

Summary of CVE-2013-2893 from provided sources : The Linux kernel HID subsystem (through version 3.11) with CONFIG_LOGITECH_FF, CONFIG_LOGIG940_FF, or CONFIG_LOGIWHEELS_FF enabled is vulnerable to a denial of service via a crafted USB HID device. The issue manifests as a heap-based out-of-bounds ...

CVE-2014-1739

CVE-2014-1739 affects the Linux kernel before 3.14.6, where the function media_device_enum_entities in drivers/media/media-device.c fails to initialize a data structure. This leads to an information disclosure vulnerability: a local attacker with access to /dev/media0 can read kernel memory throu...

CVE-2015-0274

The CVE-2015-0274 entry references the Linux kernel XFS flaw: before 3.15, the XFS implementation uses an old size value during remote attribute replacement, allowing a local attacker with XFS access to trigger a denial of service (transaction overrun/data corruption) and potentially escalate pri...

CVE-2015-2042

CVE-2015-2042 affects the Linux kernel (pre-3.19). The vulnerability lies in net/rds/sysctl.c where an incorrect data type in a sysctl table can allow local users to read potentially sensitive kernel memory via a sysctl entry, with unspecified other impact. Affected products include kernel builds...

CVE-2017-16650

CVE-2017-16650 affects the Linux kernel’s qmi_wwan_bind in drivers/net/usb/qmi_wwan.c (through kernel 4.13.11). A crafted USB device can be used by a local attacker to trigger a divide-by-zero, causing a denial of service (system crash) and potentially other impact. The vulnerability is locally e...

CVE-2020-36780

In the Linux kernel, the following vulnerability has been resolved: i2c: sprd: fix reference leak when pm_runtime_get_sync fails The PM reference count is not expected to be incremented onreturn in sprd_i2c_master_xfer() and sprd_i2c_remove(). However, pm_runtime_get_sync will increment the PM re...

CVE-2021-4439

Mode C: The connected Nessus/OpenVAS entries confirm CVE-2021-4439 affects the Linux kernel isdn/capi/kcapi.c and relates to cmtp session handling. The root cause is an array-index-out-of-bounds when detaching a controller that is not yet attached, triggering an out-of-bounds access (-1) in a 32-...

CVE-2021-47293

CVE-2021-47293 affects the Linux kernel net/sched skbmod path. The issue: tcf_skbmod_act() assumed Ethernet at L2, causing silent packet corruption for non‑Ethernet protocols (e.g., CAN vcan devices). Affected scenario shown by examples using vcan0 and skbmod swap mac; fix implemented to skip skb...

CVE-2021-47315

CVE-2021-47315 affects the Linux kernel memory driver fsl_ifc (fsl_ifc_ctrl_probe). The issue is a leak of IO memory on probe failure due to not releasing gregs on error, as reported by Smatch. The resolved description states the fix is to unmap the IO memory when probe errors occur. The impact d...

CVE-2021-47347

CVE-2021-47347 affects the Linux kernel component related to the wl1251 driver. The vulnerability arises from a buffer overflow in wl1251_cmd_scan where memcpy is invoked without validating the input length. The issue is fixed by adding a length check to ensure the copied data stays within the ma...

CVE-2021-47496

CVE-2021-47496 affects the Linux kernel net/tls path, where tls_err_abort() callers passed a negative error, causing sk->sk_err to be set to a negative value and later code to misinterpret the result, potentially leading to memory corruption. The fixes 1) ensure all tls_err_abort() calls pass ...

CVE-2021-47594

The CVE-2021-47594 entry is a legitimate Linux kernel vulnerability. It describes that the PM could close MPTCP listener subflows when deleting an endpoint, potentially affecting listener sockets bound to the endpoint IP and risking a NULL pointer dereference reported by syzbot. The connected doc...

CVE-2022-48662

CVE-2022-48662 affects the Linux kernel i915 driver (i915_gem_context.link protection). The issue arises when removing a context from the gem.contexts list during context_close(), which can poison link.next while i915_perf holds a reference, leading to a general protection fault during i915_perf_...

CVE-2022-48791

The CVE-2022-48791 issue in the Linux kernel relates to scsi: pm8001 use-after-free for aborted TMF sas_task. The problem occurs when a TMF sas_task is aborted due to a timeout and the task is freed in pm8001_exec_internal_tmf_task() while IO completion occurs later. The IO completion may still t...

CVE-2022-48946

CVE-2022-48946 concerns a Linux kernel issue in udf preallocation handling. When the first preallocation extent is the first in an extent block, the code could corrupt the extent tree header. The fix changes the behavior to discard or correctly manage preallocation at the indirect extent boundary...

CVE-2022-49027

CVE-2022-49027 pertains to the Linux kernel: the iavf_init_module() path failed to destroy a workqueue when pci_register_driver() failed, causing a resource leak. The fix adds a destroy_workqueue() call in the error path to prevent leaks, aligning with the handling in a related commit for usb/hot...

CVE-2022-49053

CVE-2022-49053 affects the Linux kernel scsi: target: tcmu component. The vulnerability arises from tcmu_try_get_data_page() returning a data page pointer without properly holding a reference under the cmdr_lock, which can allow the page to be freed by tcmu_blocks_release(), creating a use-after-...

CVE-2022-49084

CVE-2022-49084 is addressed in the Linux kernel component related to qede: a null pointer dereference can occur when build_skb() fails under memory pressure in qede_build_skb(); the fix adds a check for NULL and ensures callers handle NULL returns to prevent kernel panics. Connected advisories (E...

CVE-2022-49085

CVE-2022-49085 affects the Linux kernel’s drbd path, fixing five use-after-free bugs in get_initial_state where skb could be freed and later dereferenced. The issue arises when notify_initial_state_done and subsequent notify_*_state_change calls free skb on error, leading to a use-after-free via ...

CVE-2022-49138

CVE-2022-49138 affects the Linux kernel Bluetooth stack, specifically the hci_event path. The issue arises when multiple conn_complete events for the same handle can cause memory corruption due to repeated registrations; the kernel introduces HCI_CONN_HANDLE_UNSET and checks against HCI_CONN_HAND...

CVE-2022-49183

CVE-2022-49183: Linux kernel net/sched act_ct had a ref-leak when switching zones or network namespaces without a ct clear, leaking the old ct entry due to tcf_ct_skb_nfct_cached() returning false. The fix is to free the ct entry at tcf_ct_skb_nfct_cached() since the ct entry is not reusable. Con...

CVE-2022-49285

CVE-2022-49285 affects the Linux kernel iio: accel: mma8452 driver. The root cause was using the wrong device pointer to locate the corresponding iio data; the old logic could end up dereferencing NULL after the iio_device_alloc change. The fix corrects the data retrieval by using the API path: s...

CVE-2022-49385

CVE-2022-49385 concerns a Linux kernel UAF in the driver_base path. When driver_attach(drv) fails, the code frees driver_private but had already been added to the bus, allowing a use-after-free condition. The documented fix is to ensure the object is removed from the bus on failure, preventing th...

CVE-2022-49923

The CVE affects the Linux kernel nxp-nci path (nfc: nxp-nci: Fix potential memory leak in nxp_nci_send). The root cause is that nxp_nci_send() frees the allocated skb only on nxp_nci_i2c_write() failure; when the write succeeds, nxp_nci_i2c_write() does not free the skb, causing a memory leak. A ...

CVE-2022-49951

CVE-2022-49951 concerns the Linux kernel firmware_loader use-after-free during unregister. In firmware_upload_unregister(), device_unregister() could free fw_upload_priv via dev_release before module_put() dereferences it. The documented fix copies fw_upload_priv->module to a local variable an...

CVE-2022-50100

CVE-2022-50100 affects the Linux kernel sched/core: Do not requeue a task on a CPU excluded from cpus_mask. The issue arises from a ttwu wakeup optimization that could queue a task on the wrong CPU, triggering an early-boot warning on large machines. The commit c6e7bd7afaeb implements a fix by en...

CVE-2022-50212

CVE-2022-50212 affects the Linux kernel netfilter nf_tables subsystem. The vulnerability arises when looking up chains by ID without ensuring the chain belongs to the same table; a chain from another table can be linked in, and removing the source table can leave a rule connected to the wrong cha...

CVE-2023-52507

CVE-2023-52507 affects the Linux kernel NFC stack (nfc: nci) where the protocol is validated via a bitmask; the issue arises from an assertion that the requested protocol is below the maximum, preventing a potential shift-out-of-bounds and clarifying errors between undefined vs. unsupported proto...

CVE-2023-52984

CVE-2023-52984 affects the Linux kernel PHY code for DP83822 family: DP83825/DP83826 devices can dereference a NULL private data pointer because probe() initializes only the DP83822 path and interrupt setup is shared. The fix adds a NULL-pointer check/verifies the pointer before use, preventing t...

CVE-2023-53044

The CVE-2023-53044 entry concerns a Linux kernel vulnerability in the dm-stats path. A NULL pointer dereference can occur in dm_stats_cleanup() if alloc_percpu() fails during dm_stats_init(), with the failure not being properly propagated from alloc_precpu() or dm_stats_init() to dm_stats_cleanup...

CVE-2023-53059

CVE-2023-53059 :Vulnerability in the Linux kernel related to the Cros EC chardev path (platform/chrome) where an ioctl handling could leak kernel page data if a larger insize is provided in struct cros_ec_command when issuing EC host commands. The issue enables an information disclosure (confiden...

CVE-2024-26747

The Linux kernel contains a NULL pointer issue within the usb: roles component. The vulnerability occurs because the usb role class driver attempts to obtain a reference to the module of the usb_role_switch parent device. If the parent device is removed before the user successfully selects the us...

CVE-2024-26832

CVE-2024-26832 affects the Linux kernel mm: zswap writeback path. The fix unlocks and releases the folio obtained from __read_swap_cache_async() before returning, preventing a potential folio from being stranded. Connected advisories confirm a patch in kernel releases (e.g., Linux kernel 6.1.82 i...

CVE-2024-26871

CVE-2024-26871 is a Linux kernel vulnerability affecting F2FS where a NULL pointer dereference can occur in f2fs_submit_page_write() due to io->bio being NULL in a race condition. The fix relocates zone-end calculation to run for each fio before skip handling, preventing dereference when multi...

CVE-2024-35803

CVE-2024-35803 affects the Linux kernel, specifically the x86 efistub in mixed-mode boot handling. The root cause is that EFI boot service calls were made using the decompressor’s 16k boot stack during 32‑bit firmware entry paths, while EFI boot services require a larger (128k) stack. This mismat...

CVE-2024-36973

CVE-2024-36973 is a Linux kernel vulnerability in the misc: microchip: pci1xxxx path. The issue is a double free in the error handling of gp_aux_bus_probe, where memory freed by ida_free() and kfree(aux_device_wrapper) could be freed again if auxiliary_device_add() fails and calls auxiliary_devic...

CVE-2024-38549

CVE-2024-38549 affects the Linux kernel in the DRM/mediatek path: mtk_drm_gem_obj lacked a 0-byte allocation check, potentially leading to a kernel panic when a userspace app allocates a 0x0 GBM buffer. The fix adds a 0-byte allocation check in mtk_drm_gem_init, and testing on MT8188 confirms tha...

CVE-2024-38552

The CVE-2024-38552 issue affects the Linux kernel DRM/AMD display path, specifically the color transformation function. A potential index out-of-bounds can occur when i exceeds TRANSFER_FUNC_POINTS, risking buffer overflow in output_tf->tf_pts.red/green/blue. The fix adds a bounds check for i,...

CVE-2024-39293

CVE-2024-39293 concerns the Linux kernel: reverting the patch that allowed redirect to any socket bound to the same umem can cause multiple NAPI instances to access the same Rx/XDP ring concurrently, corruptting the ring state and potentially crashing during __xsk_flush(). A fix/revert has been a...

CVE-2024-39485

The CVE-2024-39485 issue affects the Linux kernel media: v4l subsystem, specifically the async notifier: the notifier_entry was not re-initialised after unregister, leaving dangling pointers. The documented fix is to reinitialise the notifier_entry (e.g., via list_del_init()) so the notifier_entr...

CVE-2024-41019

CVE-2024-41019 affects the Linux kernel NTFS3 implementation (fs/ntfs3). The issue arises from insufficient validation when traversing the FF offset, where an out-of-bounds read could occur if the second FF is a large offset, despite an initial check on rt->first_free. The connected documents ...

CVE-2024-42065

CVE-2024-42065 relates to the Linux kernel DRM/XE path. A NULL pointer dereference vulnerability in xe_ttm_stolen_mgr_init was fixed by adding an explicit NULL check to ensure the mgr is not NULL before use. The patch updates the function to validate the mgr reference and prevents dereferencing a...

CVE-2024-42121

CVE-2024-42121 is a Linux kernel vulnerability affecting the DRM/AMD display path. The issue arises from how msg_id is used as an array index and can be negative (not equal to MOD_HDCP_MESSAGE_ID_INVALID, -1). The root cause is missing validation of msg_id before read/write operations, leading to...

CVE-2024-42286

CVE-2024-42286 affects the Linux kernel SCSI QLA2XXX driver, where nvme_local_port validation was incorrect. The issue could lead to a NULL pointer dereference and a kernel crash (workqueue qla2xxx, nvme_fc_register_remote). Public docs confirm a resolution via upstream kernel fixes (scsi: qla2xx...

CVE-2024-42299

CVE-2024-42299 : In the Linux kernel, the NTFS3 file system handler (fs/ntfs3) fixes an issue where log->page_mask and log->page_bits were not updated when log->page_size changed during log_replay after mounting an NTFS filesystem on a system with a different PAGE_SIZE. This mismatch cou...

CVE-2024-42309

CVE-2024-42309 affects the Linux kernel (drm/gma500, psb_intel_lvds_get_modes). Root cause: drm_mode_duplicate() may fail and return NULL, risking a NULL pointer dereference. Fix: added a check to avoid NP Dereference. Impact: NULL pointer dereference could lead to a kernel crash; exploitation de...

CVE-2024-43847

CVE-2024-43847 affects the Linux kernel wireless driver ath12k (reported under the Linux kernel vulnerability about fragmented packets). The issue arises when the monitor ring and the reo reinject ring share the same ring mask index; an interrupt on the reo reinject ring can cause the monitor rin...

CVE-2024-46749

CVE-2024-46749 affects the Linux kernel Bluetooth driver btnxpuart. The vulnerability stems from a NULL pointer dereference in btnxpuart_flush(), which could crash the kernel when removing the driver after a failed or incomplete firmware download. The fix adds a guard before freeing rx->skb in...

CVE-2024-46827

The CVE-2024-46827 entry describes a Linux kernel fix for ath12k Wi‑Fi: when an association request contains an Extended HE Capabilities Element with an invalid MCS-NSS, the driver passes a zero peer_nss to firmware, potentially crashing it. The remediation implements validation of peer_nss and f...