CVE-2009-2910

CVE-2009-2910 affects the Linux kernel’s ia32 entry path on x86_64. The issue is that arch/x86/ia32/ia32entry.S does not clear certain kernel registers before returning to user mode, which allows a local attacker to read register values from an earlier process after switching an ia32 process into...

CVE-2024-46697

The CVE-2024-46697 issue in the Linux kernel’s nfsd path (nfsd4_fattr_args.context) is fixed: if a goto out path executes before security label checks, an uninitialized args.context on the stack could be freed. The mitigation is to zero/initialize args.context early, preventing a use-after-free/M...

CVE-2024-46825

CVE-2024-46825 involves the Linux kernel wifi (iwlwifi mvm) where the firmware link ID is checked using WARN_ON() instead of IWL_FW_CHECK. The fix changes the lookup function iwl_mvm_rcu_fw_link_id_to_link_conf() to use IWL_FW_CHECK() when validating firmware-provided input. Public docs show this...

CVE-2024-47658

CVE-2024-47658 affects the Linux kernel crypto: stm32/cryp, where the finalize operation in interrupt context could trigger a spinlock recursion warning if BH is not properly disabled. The OSV entries show concrete remediation: Root has patched CVE-2024-47658 in the linux package for Root:Ubuntu:...

CVE-2024-47746

CVE-2024-47746 affects the Linux kernel fuse subsystem. The issue arises when FUSE_I_CACHE_IO_MODE is set and an exclusive lock is not used, potentially causing fuse_file_cached_io_open to wait indefinitely. The root cause is locking mode for this flag; the fix is to switch to exclusive locking w...

CVE-2024-50011

CVE-2024-50011 is a Linux kernel vulnerability describing an ASoC: Intel soc-acpi-intel-rpl-match issue where an empty item is required in struct snd_soc_acpi_link_adr[]. The root cause is the absence of a links_num and the test !link->num_adr to end the loop in hda_sdw_machine_select(), which...

CVE-2024-50174

CVE-2024-50174 affects the Linux kernel’s panthor DRM path. The issue is a race between retrieving a pointer from an XArray and incrementing its reference count when converting a group handle to a group object. The documented fix is to hold the internal XArray lock while incrementing the referenc...

CVE-2024-50289

CVE-2024-50289 concerns the Linux kernel media/av7110 driver (av7110_ca.c) with a spectre-related flaw reported by the smatch tool in dvb_ca_ioctl() for av7110->ci_slot. The issue was fixed in the kernel through the patches referenced (e.g., git.kernel.org stable commits 458ea1c0... and f39272...

CVE-2024-53107

CVE-2024-53107 affects the Linux kernel in fs/proc/task_mmu.c (pagemap_scan_get_args). The issue is an integer overflow: arg->vec_len is read as a u64 from user space and used in the expression arg->vec_len * sizeof(struct page_region), which can wrap. The fix uses size_mul() to perform the...

CVE-2025-21677

CVE-2025-21677 describes a Linux kernel PFCP issue where the device is destroyed along with the UDP socket’s netns. The root cause is that pfcp_newlink() links the PFCP device to dev_net(dev) rather than the socket’s netns, so removing netns ns1 can leave the device alive in dev_net(dev) and trig...

CVE-2025-21888

Technical details about CVE-2025-21888 are not provided in the supplied Connected documents. Public disclosures in these sources reference the CVE among broader Ubuntu kernel advisories, but do not expose affected products, impact, or fixes here. Monitor for updates.

CVE-2025-21953

CVE-2025-21953 describes a Linux kernel issue in the mana subsystem (MANA VM) triggered during hibernation. If mana_gd_resume() fails while creating HWC, mana_port_debugfs is not reinitialized and may point to an older, cleaned-up dentry. Later in the hibernate path, during power_down(), mana_gd_...

CVE-2025-21973

CVE-2025-21973 affects the bnxt Ethernet driver (bnxt_get_queue_stats_rx/tx) in the Linux kernel. If an interface is down, qstats-get may access cp_ring/tx_ring without null checks, causing a NULL pointer dereference and kernel panic. Reproducer steps are provided in the description. The issue ha...

CVE-2025-22043

The CVE-2025-22043 entry concerns the Linux kernel ksmbd component where a missing bounds check in the durable handle context was fixed. Affected area: ksmbd’s durable handle context in the SMB server code (fs/smb/server/smb2pdu.c). Cause: missing bounds check allowing operations outside the buff...

CVE-2025-22059

Technical details beyond what is provided in the initial document are not publicly available in the connected documents. Monitor for updates from vendors and security advisories.

CVE-2025-22074

The CVE-2025-22074 issue concerns the ksmbd component in the Linux kernel where r_count increments are not paired with decrements except when an oplock break wait occurs. This can make r_count go negative, which may prevent the ksmbd thread from terminating. Technical detail confirmed in connecte...

CVE-2025-37834

CVE-2025-37834 affects the Linux kernel, specifically the mm/vmscan path. When a dirty swapcache page labeled hwpoison is isolated during reclaim and not locked, a memory failure can lead to the page being returned to the LRU and later cause a VM_BUG_ON_FOLIO during a subsequent reclaim. The issu...

CVE-2025-37857

CVE-2025-37857 affects the Linux kernel scsi: st driver. It fixes an array overflow in st_setup() by changing the array size from a fixed value to follow the parms size.

CVE-2025-37901

The CVE-2025-37901 issue affects the Linux kernel irqchip/qcom-mpm driver. On Qualcomm chipsets, some GPIOs are not wake-capable and lack a corresponding MPM pin; the IRQ domain hierarchy is still applied unless explicitly disconnected. This caused crashes when setting up interrupts for non-wake ...

CVE-2025-37905

CVE-2025-37905 affects the Linux kernel in the firmware: arm_scmi subsystem, where destroying SCMI devices via device_find_child() creates an unbalanced device refcount because device_find_child() performs an implicit get_device(). This prevents release methods from running during destruction, ca...

CVE-2025-37926

CVE-2025-37926 concerns the Linux kernel’s ksmbd component. A_use-after-free can occur due to a race between ksmbd_session_rpc_open() and __session_rpc_close(), potentially allowing exploitation when an attacker could trigger a session race. The fix adds a lock (rpc_lock) to the session to protec...

CVE-2025-37930

CVE-2025-37930 affects Linux kernels containing the drm/nouveau fix for WARN_ON in nouveau_fence_context_kill(). The issue arises because nouveau_fence_done() can signal fences, leaving signaled fences in the pending list, and a concurrent call to nouveau_fence_context_kill() could attempt to set...

CVE-2025-37936

CVE-2025-37936: Linux kernel issue in perf/x86/intel/KVM where MSR_IA32_PEBS_ENABLE loaded for a guest could be masked incorrectly when deriving PEBS_ENABLE, causing guest PEBS to be enabled unintentionally and potentially crash the guest with a flood of #PFs. The fix masks the guest MSR value us...

CVE-2025-37937

CVE-2025-37937 refers to a Linux kernel vulnerability in the objtool/media path for the dib8000 DVB frontend. The issue occurs when dib8000_set_dds() calls dib8000_read32() and receives zero, causing a divide-by-zero. The kernel fix prevents this division by zero, addressing an UBSAN warning seen...

CVE-2025-37973

CVE-2025-37973 affects the Linux kernel Wi-Fi stack, specifically the cfg80211 defragmentation logic for multi-link elements. The issue is a miscalculation during multi-link element defragmentation that adds the MLE length to the total IEs length, which can cause an out-of-bounds access if the ML...

CVE-2025-38077

CVE-2025-38077 affects the Linux kernel, in platform/x86 dell-wmi-sysman. The root cause was a potential buffer overflow when current_password_store() accessed buf[length-1] after an empty string length. A check for empty strings was added. The Azure Linux Nessus advisory confirms the fix and rec...

CVE-2025-38445

CVE-2025-38445 covers a Linux kernel issue in md/raid1 where raid1_reshape allocated a mempool on the stack and assigned it to conf->r1bio_pool, causing conf->r1bio_pool.wait.head to reference a stack address. Subsequent access in raid1_read_request/raid1_write_request paths could trigger a...

CVE-2025-71238

CVE-2025-71238 is a Linux kernel issue in the qla2xxx SCSI/BSG path where bsg_done() could be called on failure, causing a double free and possible system crash or privilege escalation. The root cause is failure paths calling bsg_done() without proper validation; fixes patch the bsg_done() invoca...

CVE-2007-4573

CVE-2007-4573 - Linux kernel IA32 system call emulation on x86_64 : A flaw in IA32 emulation on 64-bit Linux kernels (2.4.x and 2.6.x up to 2.6.22.7) can allow a local unprivileged user to gain privileges by triggering an out-of-bounds access to the system call table via the %RAX register after t...

CVE-2008-5182

The connected Nessus advisory for MiracleLinux 3 (AXSA:2009-22:03) references CVE-2008-5182 in the inotify subsystem of the Linux kernel. Affected product: MiracleLinux 3 running kernel 2.6.18-53.21AXS3. Vulnerability type/root cause: a race condition related to inotify watch removal and unmount,...

CVE-2010-0622

CVE-2010-0622 affects the Linux kernel’s wake_futex_pi path in kernel/futex.c. The advisory notes that kernels before 2.6.33-rc7 fail to handle certain unlock operations for Priority Inheritance futexes, allowing local users to trigger a denial of service (OOPS) and potentially other impacts via ...

CVE-2010-4160

The CVE-2010-4160 issue is present in the Linux kernel before 2.6.36.2, involving multiple integer overflows in the PPPoL2TP and IPoL2TP sendmsg paths (pppol2tp_sendmsg and l2tp_ip_sendmsg). The vulnerability can allow local users to trigger a denial of service through heap memory corruption and ...

CVE-2011-3209

CVE-2011-3209 affects the Linux kernel on x86 prior to 2.6.26. The div_long_long_rem implementation in include/asm-x86/div64.h can trigger a Divide Error Fault and system panic when clock_gettime is invoked by local users, leading to a denial of service. The impact is local, with a complete avail...

CVE-2013-0190

The CVE-2013-0190 entry concerns the xen_failsafe_callback function in the Xen hypervisor on Linux kernels (notably 2.6.23 and related versions). In 32-bit PVOPS guests, a local attacker can trigger an iret fault that leads to an incorrect stack pointer and stack corruption, enabling a denial of ...

CVE-2013-0914

The CVE-2013-0914 issue affects the Linux kernel (before 3.8.4) where the function flush_signal_handlers in kernel/signal.c preserves the sa_restorer field across an exec. This behavior enables local users to bypass ASLR via a crafted application using sigaction. Exploitation details are not prov...

CVE-2013-1773

CVE-2013-1773 involves a buffer overflow in the Linux kernel VFAT UTF-8 to UTF-16 conversion during a VFAT write when utf8 mount option is used. Affects Linux kernel before 3.3; local privilege escalation or system crash possible. The connected advisory set includes references to kernel patches (...

CVE-2013-2141

CVE-2013-2141 affects the Linux kernel; the do_tkill function in kernel/signal.c of kernels before 3.8.9 does not initialize a data structure, enabling local attackers to read sensitive kernel memory via crafted tkill/tgkill calls. Affected contexts are documented in MiracleLinux/OpenVAS advisori...

CVE-2014-4027

CVE-2014-4027 affects the Linux kernel prior to 3.14. The flaw is in the rd_build_device_space function (drivers/target/target_core_rd.c), where a data structure is not properly initialized, enabling local users to read sensitive information from ramdisk_mcp memory by abusing access to a SCSI ini...

CVE-2016-2548

CVE-2016-2548 affects the Linux kernel’s sound/core/timer.c prior to 4.4.1. The issue arises because the kernel may retain certain linked lists after a close or stop action (snd_timer_close and _snd_timer_stop), enabling a local attacker to trigger a denial-of-service (system crash) via a crafted...

CVE-2016-6130

CVE-2016-6130 is a race condition in the Linux kernel's sclp_ctl_ioctl_sccb path (drivers/s390/char/sclp_ctl.c) prior to 4.6 that can allow local users to disclose kernel memory by altering a length field (double fetch). The vulnerability is described as a local information-disclosure due to memo...

CVE-2017-0630

CVE-2017-0630 : Information disclosure in Android’s kernel trace subsystem. An attacker must first compromise a privileged process to access data beyond its permissions. Affected products include Android kernel versions 3.10 and 3.18 (Android ID A-34277115). The description notes an information d...

CVE-2020-36778

CVE-2020-36778 affects the Linux kernel i2c xiic subsystem. The issue is a reference leak in the PM runtime path: pm_runtime_get_sync incorrectly increments the PM usage count on return even when the operation fails, leading to a leak if the balanced put is forgotten. The fix replaces the final o...

CVE-2021-3714

CVE-2021-3714 (Linux kernel) affects the kernel’s memory deduplication mechanism. The connected sources describe a local-exploitation style attack where an adversary can upload page-sized files and observe access-time changes from a networked service to infer whether pages have been merged. This ...

CVE-2021-46994

CVE-2021-46994 concerns the Linux kernel, specifically the can: mcp251x CAN driver. The vulnerability arises when resuming from suspend: since commit 8ce8c0abcba3, the driver queues work via priv->restart_work even if the interface was not previously enabled. This can lead to a NULL pointer de...

CVE-2021-47057

CVE-2021-47057 relates to the Linux kernel crypto: sun8i-ss, where a memory leak occurred when dma_iv mapping failed. The defect occurred on the error path where object d’s memory was not freed prior to returning. The fix adds an error-return label and ensures d is freed before exit. This CVE ent...

CVE-2021-47080

CVE-2021-47080 pertains to the Linux kernel RDMA core. Affected: Linux kernel builds where user_entry_size is supplied by the user and later used as a denominator to compute the number of entries. If the user supplies 0, a divide-by-zero triggers a kernel panic (observed in ib_uverbs_handler_UVER...

CVE-2021-47126

CVE-2021-47126 is a Linux kernel IPv6 KASAN slab-out-of-bounds read vulnerability in net/ipv6/route.c (fib6_nh_flush_exceptions). The issue involved reads of 8 bytes in fib6_nh_get_excptn_bucket, leading to a slab-out-of-bounds access traced to fib6_nh_flush_exceptions and related calls. The defe...

CVE-2021-47438

CVE-2021-47438 affects the Linux kernel mlx5 driver; the root cause is a memory leak in net/mlx5e/ mlx5_core_destroy_cq() where on error path the destroy flow may not complete. The patch fixes this by ensuring the full destroy sequence runs before returning an error and by moving mlx5_debug_cq_re...

CVE-2021-47443

CVE-2021-47443 affects the Linux kernel NFC digital subsystem. The vulnerability is a memory leak in digital_tg_listen_mdaa() where 'params' is allocated but not freed if digital_send_cmd() fails. The patch adds a free of 'params' on failure, reducing leak risk. Affected versions are Linux kernel...

CVE-2021-47465

CVE-2021-47465 is a Linux kernel vulnerability affecting the PPC Book3S HV emergency stack handling. The issue occurred in idle_kvm_start_guest(), where the previous approach stored CR/LR and stack frames on the emergency stack without ensuring a valid frame boundary, causing writes outside the e...