CVE-2024-49932

CVE-2024-49932 affects the Linux kernel’s btrfs relocation path. The issue arises when relocating data extents on RAID stripe trees: readahead on the relocation inode may receive ENOENT from a RAID-based lookup, but the code does not handle the error, leading to invalid reads and a kernel bug in ...

CVE-2014-0155

The CVE-2014-0155 entry concerns the Linux kernel up to 3.14.1, where the ioapic_deliver function in virt/kvm/ioapic.c does not properly validate the return value of kvm_irq_delivery_to_apic. This can allow a guest OS user to trigger a host OS denial of service (host crash) via a crafted entry in...

CVE-2014-4014

The CVE-2014-4014 issue is a Linux kernel local privilege escalation affecting versions before 3.14.8. The root cause is that namespaces are inapplicable to inodes, allowing a local user who creates a user namespace to bypass chmod restrictions by setting the setgid bit on a file with root group ...

CVE-2016-2545

CVE-2016-2545 : Affected component is the Linux kernel; specifically the snd_timer_interrupt handler in sound/core/timer.c. The issue (pre-4.4.1) fails to maintain a linked list correctly, enabling local attackers to trigger a race condition via a crafted ioctl that can crash the system (denial o...

CVE-2016-5728

CVE-2016-5728 is a local-privilege vulnerability in the Linux kernel MIC VOP driver (drivers/misc/mic/vop/vop_vringh.c). The race condition occurs in vop_ioctl where the driver performs two successive reads from user space to read a variable-length data structure, enabling a local user to either ...

CVE-2020-36778

CVE-2020-36778 affects the Linux kernel i2c xiic subsystem. The issue is a reference leak in the PM runtime path: pm_runtime_get_sync incorrectly increments the PM usage count on return even when the operation fails, leading to a leak if the balanced put is forgotten. The fix replaces the final o...

CVE-2021-47644

CVE-2021-47644 affects the Linux kernel where the “media: staging: media: zoran” code path was updated to move videodev allocation out of zr36057_init() and create new handling functions for zr->video_dev. The change fixes a memory leak in zr->video_dev and improves code readability. The vu...

CVE-2022-47941

The CVE-2022-47941 issue affects ksmbd in Linux kernels 5.15–5.19 prior to 5.19.2. The root cause is a missing kfree in smb2pdu error paths in fs/ksmbd/smb2pdu.c, causing a memory leak. Impact is availability concerns due to memory leaks; no confidentiality or integrity impact stated. Affected ve...

CVE-2022-48631

The CVE-2022-48631 issue affects the Linux kernel’s ext4 extents parsing. Specifically, ext4_ext_binsearch_idx() could operate on an extent header with eh_depth > 0 when eh_entries is 0, leading to garbage indices and kernel crash (BUG at fs/ext4/extents.c:2258) observed in the provided traces...

CVE-2022-48946

CVE-2022-48946 concerns a Linux kernel issue in udf preallocation handling. When the first preallocation extent is the first in an extent block, the code could corrupt the extent tree header. The fix changes the behavior to discard or correctly manage preallocation at the indirect extent boundary...

CVE-2022-49084

Summary (CVE-2022-49084): The vulnerability in the Linux kernel affects the qede subsystem where qede_build_skb() assumes build_skb() always succeeds and proceeds to skb_reserve() even if it returns NULL under memory pressure. The fix adds a NULL check for build_skb() and returns NULL when alloca...

CVE-2022-49532

CVE-2022-49532 affects the Linux kernel DRM virtio driver (virtio_gpu_conn_get_modes) where drm_cvt_mode may return NULL, leading to a NULL pointer dereference. The issue is demonstrated by a KASAN report showing a null deref while reading a 4-byte value from a NULL pointer. The connected advisor...

CVE-2022-49622

CVE-2022-49622 (Linux kernel) describes a use-after-free risk in nf_tables when verdict is NF_STOLEN in netfilter, where skb freeing may have occurred. The fix prevents illegal skb access by: (1) caching skb->nf_trace in the trace state and refreshing it when verdict != STOLEN; (2) skipping sk...

CVE-2022-49623

CVE-2022-49623 : In the Linux kernel, the powerpc/xive/spapr path allocated a bitmap using bits units instead of the required long-sized units, causing a KASAN slab-out-of-bounds access on the 8-byte bitmap. The stack trace shows the access occurs during CPU setup for SMP, with the fault tied to ...

CVE-2022-49855

CVE-2022-49855 affects the Linux kernel wwan driver (net: wwan: iosm). The root cause is that ipc_pcie_read_bios_cfg() uses acpi_evaluate_dsm() to obtain BIOS power-state config but fails to free the returned acpi_object, causing a memory leak. The issue has been resolved by freeing the acpi_obje...

CVE-2023-52654

CVE-2023-52654 affects the Linux kernel io_uring implementation in the af_unix path. The issue stems from potential cycles when sending io_uring file objects over sockets via SCM_RIGHT, which could interact with unix_stream_read_generic() and file reference cycles. The mitigation described is to ...

CVE-2023-52854

CVE-2023-52854 affects the Linux kernel's padata subsystem. In high-load arm64 scenarios, a race in refcount handling can cause a Use-After-Free when pd is freed during padata_serial_worker execution, leading to a potential crash or memory corruption. The documented root cause is improper refcoun...

CVE-2023-53072

CVE-2023-53072 (Linux kernel, MPTCP) : A use-after-free UaF at token lookup during MPTCP passive socket initialization was fixed by changing cleanup order to destroy unaccepted MPTCP sockets via a workqueue, ensuring the MPC subflow cleanup ends with the msk released. The fix reuses the MPTCP_WOR...

CVE-2023-53086

The CVE-2023-53086 entry concerns the Linux kernel wifi driver mt76 in Connac where WED status was checked for non-MMIO devices. The fixed patch removes the WED check for non-MMIO (e.g., USB/SDIO), addressing a crash observed during wireless authentication/association flow. Public descriptions co...

CVE-2024-26681

CVE-2024-26681 is a Linux kernel vulnerability affecting the netdevsim driver. The issue arises in nsim_dev_trap_report_work() where failure to grab a mutex could lead to a loop/backtrace scenario, potentially impacting system stability. The vulnerability details are grounded in a kernel trace an...

CVE-2024-26787

Technical details about CVE-2024-26787 are not provided in the supplied documents. Monitor official advisories for updates on affected products, impact, and fixes.

CVE-2024-27418

CVE-2024-27418 affects the Linux kernel net: mctp component. The vulnerability is a memory leak: mctp_local_output currently frees the skb only on success, risking skb leakage if mctp_local_output fails in certain states because ownership isn’t transferred until routing occurs. The fix is to have...

CVE-2024-40920

CVE-2024-40920 affects the Linux kernel net: bridge: mst component. Root cause: br_mst_set_state was converted to RCU to avoid a VLAN use-after-free, but the vlan group dereference helper was not updated, triggering suspicious RCU usage. The fix switches to the vlan group RCU deref helper to addr...

CVE-2024-41019

CVE-2024-41019 affects the Linux kernel component fs/ntfs3. The issue arises from insufficient validation when traversing the ff offset, where an initial check is performed on rt->first_free but subsequent walking by ff occurs without a bound check. This can lead to an out-of-bounds read if a ...

CVE-2024-42086

CVE-2024-42086 pertains to the Linux kernel iio: chemical: bme680 driver, where overflow could occur in compensate() functions due to bit shifting in internal calculations. The issue affects the kernel’s IIO BME680 support and was fixed by a code patch addressing the overflow paths in compensate(...

CVE-2024-42117

CVE-2024-42117 affects the Linux kernel DRM/AMD display path. The root cause was that find_disp_cfg_idx_by_plane_id and find_disp_cfg_idx_by_stream_id could return -1 and that value was used as an index, causing overrun/negative-return conditions. The fix is to return a valid positive index or ta...

CVE-2024-42119

The CVE-2024-42119 entry concerns a Linux kernel issue in drm/amd/display where the code pathSkip finding free audio for unknown engine_id (ENGINE_ID_UNKNOWN = -1) could be mishandled as an array index. The root cause is that ENGINE_ID_UNKNOWN is -1 and uninitialized, leading to unnecessary free ...

CVE-2024-42241

The CVE-2024-42241 issue affects the Linux kernel’s PMD-sized page cache in shmem files. When the HPAGE_PMD_ORDER exceeds MAX_PAGECACHE_ORDER, PMD-sized page caches may not be supported by xarray, leading to errors like xas_split_alloc, split_huge_page_to_list_to_order, and related fallocate/shme...

CVE-2024-43829

CVE-2024-43829 involves a null-pointer dereference vulnerability in the Linux kernel related to the DRM/QXL driver. The advisory states that a check was added for drm_cvt_mode and that the return value of drm_cvt_mode() must be validated; if the function fails, the error is returned to prevent a ...

CVE-2024-43868

CVE-2024-43868 is a Linux kernel flaw in the riscv purgatory alignment path. When alignment handling is delegated to the kernel, purgatory must keep all addresses word-aligned because the kexec trap handler is used. If alignment isn’t enforced, hitting the exception could crash the system; in oth...

CVE-2024-46810

CVE-2024-46810 affects the Linux kernel UI path for displays: the drm/bridge tc358767 code may signal HPD events via IRQ before the connector is fully initialized, risking a NULL pointer dereference. The connected documents confirm a fix was applied by ensuring the connector is fully initialized ...

CVE-2024-46827

The CVE-2024-46827 entry describes a Linux kernel fix for ath12k Wi‑Fi: when an association request contains an Extended HE Capabilities Element with an invalid MCS-NSS, the driver passes a zero peer_nss to firmware, potentially crashing it. The remediation implements validation of peer_nss and f...

CVE-2024-46845

CVE-2024-46845 (Linux kernel): The timerlat use-after-free occurs when a SIGTERM kills user-space tracing threads, causing an hrtimer to be freed twice during thread shutdown. The documented fix cancels the hrtimer only if the associated thread still exists and adds an interface_lock around tlat_...

CVE-2024-47702

CVE-2024-47702 affects the Linux kernel BPF verifier. It exposes a sign-extension error when loading packet fields (__sk_buff->data/data_end/data_meta), where a 32‑bit sign extension can yield an invalid pointer if the value is treated as 64‑bit. The issue arises from how sign-extension intera...

CVE-2024-47733

CVE-2024-47733 affects the Linux kernel netfs subsystem: netfs_init()/fscache_proc_init() creates a dentry under fs/netfs, but netfs_exit() only removes the proc entry, not its subtree, causing a non-empty directory to be removed and a leak of entries (e.g., 'requests'). The fix is to use remove_...

CVE-2024-50253

In CVE-2024-50253, the Linux kernel fixes a memory-allocator bug in the BPF subsystem: nr_words can overflow nr_bits in bpf_iter_bits_new(), risking stack corruption via bpf_probe_read_kernel_common when nr_words is large (e.g., 0x0400-0001). The patch constrains nr_words to a maximum of 511 and ...

CVE-2024-50281

In CVE-2024-50281, the Linux kernel vulnerability affects the KEYS: trusted: dcp path where sealing/unsealing a key blob could exit before the AEAD cipher operation completes, risking NULL dereference in the DCP driver when the buffer has been removed from the stack. The underlying cause is not w...

CVE-2024-50289

CVE-2024-50289 concerns the Linux kernel media/av7110 driver (av7110_ca.c) with a spectre-related flaw reported by the smatch tool in dvb_ca_ioctl() for av7110->ci_slot. The issue was fixed in the kernel through the patches referenced (e.g., git.kernel.org stable commits 458ea1c0... and f39272...

CVE-2024-57852

CVE-2024-57852 affects the Linux kernel firmware: qcom: scm: smc handling of missing SCM device. The root cause is a NULL pointer dereference in qcom_scm_get_tzmem_pool(), which may return NULL and requires callers to handle it. The issue is addressed by the commit ca61d6836e6f, which makes the n...

CVE-2024-57944

CVE-2024-57944 : In the Linux kernel, the IIO ADC TI ADS1298 driver (ads1298_init) contains a missing NULL check for the return value of devm_kasprintf(), which can return NULL on failure. The vulnerability exposes a local impact with a HIGH availability impact as described by CVSS: AV:L/AC:L/PR:...

CVE-2024-57994

CVE-2024-57994 : In the Linux kernel, a bug in ptr_ring_resize_multiple caused a splat when hard interrupts were blocked inside the resize path. The fix removes masking of hard IRQs (now only BHs are blocked) and adds a lockdep_assert_no_hardirq() check in __page_pool_put_page() to improve test c...

CVE-2024-58077

CVE-2024-58077 affects the Linux kernel ASoC: soc-pcm path. The root cause is invoking soc_pcm_ret() on the .prepare callback, which previously ignored -EINVAL to avoid user-space DoS via logs. The fix changes behavior to stop using soc_pcm_ret() in the .prepare callback, addressing the invalid-p...

CVE-2024-58095

CVE-2024-58095 (jfs: add check read-only before txBeginAnon() call) is confirmed as a concrete kernel fix. The patch introduces a read-only check prior to txBeginAnon() in extAlloc and extRecord within the JFS code path. This prevents write attempts on a read-only mounted filesystem, avoiding pot...

CVE-2025-21733

CVE-2025-21733 is addressed in the OSV entry for ROOT-OS-UBUNTU-2404-CVE-2025-21733, which states that the vulnerability was patched in the rootio-linux package for Root:Ubuntu:24.04. Root has released multiple fixed versions. The description confirms a patched fix rather than active exploitation...

CVE-2025-21742

CVE-2025-21742 affects the Linux kernel’s usbnet: ipheth handling within URB buffers. The vulnerability arose because the start of the NDP16 block could be placed anywhere in the URB based on wNdpIndex, allowing the fixed-length portion of NDP16 to extend past the URB end and trigger an OoB read....

CVE-2025-21783

CVE-2025-21783 affects the Linux kernel gpiolib: gpiochip_get_ngpios() uses chip_() macros that assume gpiodev is initialised. When called via bgpio_init(), these macros can crash with a NULL pointer dereference. The fix replaces chip_ () with the corresponding dev_() macros to prevent the crash....

CVE-2025-21790

CVE-2025-21790 fixes a kernel-space issue in the vxlan code. The vulnerable path is in vxlan_vnigroup_init() not being checked by vxlan_init(), which can lead to a NULL dereference or general protection fault later when vxlan_dev is created/unregistered (local attacker with access to the kernel c...

CVE-2025-21985

CVE-2025-21985 : In the Linux kernel DRM/AMD display path, the fix addresses out-of-bounds accesses. Specifically, hpo_stream_to_link_encoder_mapping is sized MAX_HPO_DP2_ENCODERS(=4) but can reference up to 6 elements, so the location must be checked against MAX_HPO_DP2_ENCODERS. Also, disp_cfg_...

CVE-2025-22043

The CVE-2025-22043 entry concerns the Linux kernel ksmbd component where a missing bounds check in the durable handle context was fixed. Affected area: ksmbd’s durable handle context in the SMB server code (fs/smb/server/smb2pdu.c). Cause: missing bounds check allowing operations outside the buff...

CVE-2025-37917

The CVE-2025-37917 issue is in the Linux kernel MTK Star EMAC driver (mtk_star_emac). It describes spinlock recursion that can occur when DMA interrupts are re-enabled during rx/tx polling. The documented fix replaces spin_lock/spin_unlock with spin_lock_irqsave/spin_unlock_irqrestore in mtk_star...