CVE-2025-37969

In CVE-2025-37969, the Linux kernel vulnerable component is the IIO IMU driver st_lsm6dsx (read_tagged_fifo). The issue allows a potential lockup when pattern_len is zero and the device FIFO is not empty, risking an infinite loop and elevated availability impact. The vulnerability has been fixed ...

CVE-2025-38349

The CVE-2025-38349 entry concerns a Linux kernel eventpoll use-after-free risk due to dropping the epoll refcount while the ep mutex is still held. Description and related details explain that incrementing/decrementing the ep refcount in the wrong order combined with unlock timing can allow a con...

CVE-2009-0745

CVE-2009-0745 concerns the Linux kernel ext4 resize path. The ext4_group_add function in fs/ext4/resize.c fails to properly initialize the group descriptor during a resize (resize2fs), which can allow a local attacker to trigger a denial of service (OOPS) by manipulating crafted values in memory....

CVE-2010-2963

CVE-2010-2963 affects the Linux kernel’s Video4Linux (V4L) implementation on x86_64, where a flaw in the v4l2-compat ioctl32 code fails to validate the destination of a memory copy, enabling a local user to write arbitrary kernel memory via VIDIOCSTUNER on a /dev/video device followed by VIDIOCSM...

CVE-2011-5327

The CVE-2011-5327 issue affects the Linux kernel prior to 3.1, where an off-by-one in the function drivers/target/loopback/tcm_loop.c: tcm_loop_make_naa_tpg() can cause memory corruption. This root cause is stated across the CVE entry and related advisories, with impact described as memory corrup...

CVE-2013-7266

CVE-2013-7266 affects the Linux kernel code path in drivers/isdn/mISDN/socket.c up to version 3.12.3. The function mISDN_sock_recvmsg does not consistently validate length against the related data structure, enabling local attackers to read kernel memory via (1) recvfrom, (2) recvmmsg, or (3) rec...

CVE-2013-7470

The vulnerability CVE-2013-7470 affects the Linux kernel's cipso_v4_validate (net/cipso_ipv4.h) before 3.11.7 when CONFIG_NETLABEL is disabled, allowing a denial of service (infinite loop and crash) as demonstrated by icmpsic. Nessus/NVD entries confirm affected kernel versions include up to 3.11...

CVE-2014-8172

CVE-2014-8172 affects the Linux kernel prior to 3.13, where files list handling uses an inappropriate locking approach around Asynchronous I/O (AIO). This local-denial-of-service flaw can cause soft lockups or a system crash. The available documentation confirms the vulnerability and its local at...

CVE-2015-5697

CVE-2015-5697 (Linux kernel) : The get_bitmap_file function in drivers/md/md.c in the Linux kernel before 4.1.6 does not initialize a bitmap data structure, allowing local attackers to read sensitive kernel memory via the GET_BITMAP_FILE ioctl. This is a local information disclosure vulnerability...

CVE-2015-8963

CVE-2015-8963 : The Linux kernel contains a race condition in kernel/events/core.c related to swevent handling during a CPU unplug operation. Affected: Linux kernel versions before 4.4. Impact: local privilege escalation or denial of service (use‑after‑free) as described in the vulnerability entr...

CVE-2016-2063

CVE-2016-2063 is a stack-based overflow in the MSM Thermal driver for the Linux kernel 3.x. The vulnerability resides in supply_lm_input_write within drivers/thermal/supply_lm_core.c and can be triggered by sending a large amount of data via the debugfs interface, enabling a local attacker to cau...

CVE-2017-16996

The CVE-2017-16996 entry affects the Linux kernel (up to version 4.14.8) in kernel/bpf/verifier.c, where register truncation mishandling is the root cause. This allows local users to trigger memory corruption and potentially other impacts described as a denial of service. The vulnerability is res...

CVE-2019-18786

In CVE-2019-18786, the Linux kernel up to version 5.3.8 contains an uninitialized f->fmt.sdr.reserved in rcar_drif_g_fmt_sdr_cap (drivers/media/platform/rcar_drif.c), enabling an information disclosure (memory disclosure) vulnerability. Connected advisories (Unity Nessus plugins) restate that ...

CVE-2021-46993

CVE-2021-46993 — Linux kernel sched: out-of-bounds access in uclamp bucket calculation. Util-clamp places tasks into buckets based on clamp values; with, e.g., 20 buckets, bucket size computed as 1024/20=51 can map a clamp of 1024 to bucket id 20, while valid indexes are 0–19, causing OOB access....

CVE-2021-47142

CVE-2021-47142 concerns the Linux kernel’s DRM/AMDGPU stack. The vulnerability stems from a use-after-free in the AMDGPU TTM memory backend when cleaning up objects, specifically due to not clearing ttm->sg (the sg table) which can lead to a general protection fault during teardown. The connec...

CVE-2021-47267

CVE-2021-47267 affects the Linux kernel USB gadget code: if a gadget driver calls usb_assign_descriptors() with a NULL super-speed-plus descriptor and the system runs at 10Gbps, a null pointer dereference can crash the kernel when a 10Gbps device port, cable, and host port are detected. The docum...

CVE-2021-47354

CVE-2021-47354 affects the Linux kernel’s DRM scheduler. The issue arises from not waiting for all dependencies of a job to complete before terminating it, which could lead to data corruption. The published notes describe the vulnerable component as the kernel’s DRM/sched path and the fix as ensu...

CVE-2021-47473

CVE-2021-47473 affects the Linux kernel SCSI qla2xxx path. The issue is a memory leak in the error path of qla2x00_process_els() caused by an incorrect comparison of bsg_job->request->msgcode, which could leak fcport structures or free unallocated memory. The patch fixes the logic by ensuri...

CVE-2021-47645

CVE-2021-47645 affects the Linux kernel media subsystem (staging: media: zoran). The root cause is a miscalculated buffer index in zoran_reap_stat_com when tmp_dcim=1, which can lead to a NULL pointer dereference. Patches were applied to correct the calculation and add a defensive check to preven...

CVE-2022-48962

CVE-2022-48962 affects the Linux kernel net layer via the hisilicon driver code path net: hisilicon: Fix potential use-after-free in hisi_femac_rx(). The skb can be delivered to napi_gro_receive() which may free it; dereferencing the skb after that may trigger a use-after-free. The connected Tena...

CVE-2022-48970

CVE-2022-48970 : In the Linux kernel, a NULL pointer dereference in af_unix handling can occur when unix_diag_get_exact() processes a netlink message because a newly allocated skb may not have skb->sk. The root cause is that unix_diag_get_exact() must obtain the user namespace from the NETLINK...

CVE-2022-48983

CVE-2022-48983 is a Linux kernel vulnerability where a NULL pointer dereference in io_tctx_exit_cb() could occur during io_uring/cancellation interplay, leading to a kernel panic. The issue arose when task_work added by io_ring_exit_work() could race with cancellation of exec work, causing curren...

CVE-2022-48987

CVE-2022-48987 affects the Linux kernel in media: v4l2-dv-timings.c. The issue was a misapplied blanking sanity check: when userspace supplies only a total blanking value, the total could be assigned to front porch, backporch, or sync fields, causing an overflow check to fail. The fix adds maximu...

CVE-2022-49139

CVE-2022-49139 affects the Linux kernel Bluetooth stack. The issue occurs in the HCI handling path: upon receiving a HCI_Synchronous_Connection_Complete for a BDADDR of an existing LE connection, with LE link type and a status triggering the second packet-processing case, a NULL pointer dereferen...

CVE-2022-49183

CVE-2022-49183: Linux kernel net/sched act_ct had a ref-leak when switching zones or network namespaces without a ct clear, leaking the old ct entry due to tcf_ct_skb_nfct_cached() returning false. The fix is to free the ct entry at tcf_ct_skb_nfct_cached() since the ct entry is not reusable. Con...

CVE-2022-49219

CVE-2022-49219 concerns a memory-leak in the Linux kernel VFIO PCI driver during D3hot↔D0 transitions. If vfio_pci_core_device::needs_pm_restore is set, the current PCI state is saved in pm_save on D0→D3hot and would be restored on D3hot→D0. The code uses pci_store_saved_state() to save state and...

CVE-2022-49259

The CVE-2022-49259 item concerns a Linux kernel bug where a kobject (queue) could be deleted before its child kobjects, triggering a kernel WARN. The vulnerability stems from improper deletion order in the sysfs/kobject lifecycle, leading to a possible sysfs group not found warning (e.g., 'sysfs...

CVE-2022-49292

CVE-2022-49292 is tied to the Linux kernel ALSA oss PCM buffer allocation overflow. The vulnerability occurs when snd_pcm_plug_alloc() may allocate an oversized temporary buffer during data conversion if hardware parameters allow larger-than-expected period/buffer sizes, risking an INT_MAX overfl...

CVE-2022-49873

The CVE-2022-49873 entry concerns the Linux kernel eBPF verifier. The release_reference() path could leave memory-allocated resources unfreed, causing registers tied to released pointers to be marked as SCALAR_VALUE, which in turn may allow an unprivileged user to observe a kernel pointer when st...

CVE-2022-49930

CVE-2022-49930 affects the Linux kernel in the RDMA/hns path (free_mr_init) where a race can cause a NULL pointer dereference when a lock is grabbed concurrently without proper initialization. The vulnerability leads to an in-kernel NULL dereference (call trace beginning at __mutex_lock.constprop...

CVE-2022-49940

CVE-2022-49940 concerns the Linux kernel tty/n_gsm subsystem. The vulnerability arises when gsmld_receive_buf() may call gsm->receive() even if gsm->receive is not initialized, leading to a NULL pointer dereference. The fix adds a sanity check to avoid invoking gsm->receive() if the func...

CVE-2023-38428

CVE-2023-38428 affects the Linux kernel (ksmbd) where fs/ksmbd/smb2pdu.c does not properly validate the UserName value because it ignores the address of the security buffer, causing an out-of-bounds read. The public description confirms the issue exists in kernels before 6.3.4. The connected docs...

CVE-2023-52562

CVE-2023-52562 affects the Linux kernel, specifically the slab allocator path in mm/slab_common. The root cause is a slab_caches list corruption that can occur when a module creates a slab cache but does not release all allocated objects before destroying the cache at rmmod time, causing kmem_cac...

CVE-2023-52596

CVE-2023-52596: Linux kernel sysctl out-of-bounds access when registering empty sysctl directories. Root cause: a check tests the first element of ctl_table for a permanently empty directory, leading to out-of-bounds. Mitigation in the patched code: register_sysctl_mount_point now passes a ctl_ta...

CVE-2023-52616

The CVE-2023-52616 issue affects the Linux kernel crypto/lib/mpi code, specifically mpi_ec_init. The root cause is that the mpi_ec_ctx structure’s fields may not be cleared during initialization, which can lead to references to uninitialized data when the structure is released, causing a crash. T...

CVE-2023-53000

CVE-2023-53000 is a Linux kernel vulnerability affecting the netlink attribute handling. The issue arises when the netlink attribute type (nla_type) is used as an index after validation, enabling a possible Spectre v1 gadget to leak kernel memory to a local attacker. The public description notes ...

CVE-2023-53044

The CVE-2023-53044 entry concerns a Linux kernel vulnerability in the dm-stats path. A NULL pointer dereference can occur in dm_stats_cleanup() if alloc_percpu() fails during dm_stats_init(), with the failure not being properly propagated from alloc_precpu() or dm_stats_init() to dm_stats_cleanup...

CVE-2023-53110

The CVE-2023-53110 issue is in the Linux kernel net/smc path, where a race between smc_smcr_terminate_all() and smc_buf_create() can lead to a NULL sndbuf_desc being dereferenced in smc_cdc_tx_handler(), triggering a panic during SMC-R termination under stress. The available connected advisories ...

CVE-2024-26648

CVE-2024-26648 affects the Linux kernel’s drm/amd/display path (AMDGPU) where in edp_setup_replay() a dereference of “struct dc *dc” and “struct dmub_replay *replay” occurred before validating NULL pointers for “link” and the replay, leading to a potential crash. The fix updates the AMD display c...

CVE-2024-26677

CVE-2024-26677 : In the Linux kernel’s rxrpc implementation, the vulnerability stems from how delayed ACKs were constructed with a reference serial number, making them unsuitable as an RTT reference. The issue has been resolved in the kernel by fixing the construction of delayed ACKs to avoid set...

CVE-2024-26771

Linux kernel CVE-2024-26771Fix: The TI edma (dmaengine) driver now includes null-pointer checks in edma_probe to guard against NULL from devm_kasprintf() (which can return NULL on failure). This prevents a potential NULL dereference in the kasprintf allocation path. Patch references in the Linux ...

CVE-2024-26792

CVE-2024-26792 : Linux kernel bug in btrfs snapshot creation can cause a double free of an anonymous device number. Root cause: during snapshot creation, anon_dev is allocated, later freed in nested calls, and if the transaction path fails, the same anon_dev may be freed again even if it has been...

CVE-2024-35932

CVE-2024-35932 affects the Linux kernel DRM VC4 driver. The issue is in non-blocking commits where the check plane->state->fb == state->fb is not reliably protected, causing potential refcount underflow across prepare_fb/cleanup_fb. The root cause is that drm_plane.state should not be ac...

CVE-2024-36026

CVE-2024-36026 affects the Linux kernel DRM/AMD PM path (drm/amd/pm). The issue causes random hangs during S4 stress tests when using SMU v13.0.4/11, as GC/RLC/PMFW can enter an invalid state and trigger hard hangs. A workaround implemented in the patch adds a GFX reset just before sending the MP...

CVE-2024-42137

CVE-2024-42137 concerns a Linux kernel Bluetooth issue for Qualcomm Atheros (QCA6390). The vulnerability stemmed from a regression introduced by commit 272970be3dab, which fixed a use-after-free in qca_serdev_shutdown() but caused Bluetooth enablement to fail after a warm reboot if enable-gpios w...

CVE-2024-42274

CVE-2024-42274 affects the Linux kernel’s ALSA firewire-lib. Reverting commit 7ba5ca32fe6e caused by removing the process-context workqueue from amdtp_domain_stream_pcm_pointer() and update_pcm_pointers() introduced AB/BA deadlock competition for the substream lock, potentially freezing systems u...

CVE-2024-42281

CVE-2024-42281 is a Linux kernel vulnerability fixed by the upstream commit: bpf: Fix a segment issue when downgrading gso_size. The fix linearizes the skb when downgrading gso_size to prevent a BUG_ON() later during skb segmentation as described in citations [1,2]. The provided documents confirm...

CVE-2024-43819

CVE-2024-43819 : In the Linux kernel, KVM for s390 was updated to reject user memory region operations on ucontrol VMs. Specifically, KVM_SET_USER_MEMORY_REGION and KVM_SET_USER_MEMORY_REGION2 ioctls are now rejected for ucontrol VMs because their kvm->arch.gmap is set to 0, which could lead t...

CVE-2024-43886

The connected Astra Linux bulletin confirms CVE-2024-43886 affects the Linux kernel in the DRM/AMD display path, specifically a risk in resource_log_pipe_topology_update within dc_resource.c. The root cause is a potential null pointer dereference when switching from “Extend” to “Second Display On...

CVE-2024-44959

The CVE-2024-44959 entry concerns the Linux kernel tracefs component. It describes a root cause in the in-kernel memory reclaim path where structure layout randomization of struct inode can cause overlapping or misused RCU fields during freeing, potentially triggering list corruption (list_del) a...