CVE-2025-38077

CVE-2025-38077 affects the Linux kernel, in platform/x86 dell-wmi-sysman. The root cause was a potential buffer overflow when current_password_store() accessed buf[length-1] after an empty string length. A check for empty strings was added. The Azure Linux Nessus advisory confirms the fix and rec...

CVE-2025-38084

CVE-2025-38084 affects the Linux kernel mm/hugetlb subsystem. Description: unshare of hugetlb page tables during VMA split occurs too early (before VMA/rmap locks), enabling racing page faults and rmap walks to share page tables before split. The fix: call hugetlb unshare logic from __split_vma()...

CVE-2004-0077

CVE-2004-0077 corresponds to a bounds-checking flaw in the Linux kernel mremap implementation (2.2 to 2.6.2). The issue arises when do_munmap return value is not properly checked after exceeding the maximum VMA descriptors, enabling a local attacker to gain root privileges. Connected advisories c...

CVE-2005-0750

CVE-2005-0750 affects the Bluetooth driver in the Linux kernel (2.4.6–2.4.30-rc1 and 2.6–2.6.11.5). The bluez_sock_create function fails to validate a negative protocol value, allowing a local user to gain privileges via a crafted socket or socketpair call. Public details appear in multiple advis...

CVE-2010-2492

CVE-2010-2492 affects the Linux kernel’s eCryptfs component: a buffer overflow in the ecryptfs_uid_hash macro (fs/ecryptfs/messaging.c) could allow local privilege escalation or a denial of service. The MiracleLinux AXSA advisory lists this CVE among kernel issues and specifies the flaw occurs in...

CVE-2011-0726

The CVE-2011-0726 entry is supported by connected advisories describing a Linux kernel vulnerability in do_task_stat (fs/proc/array.c) present in kernels before 2.6.39-rc1. The flaw allows local users to defeat ASLR by reading start_code/end_code from /proc/[pid]/stat for PIE processes, implying ...

CVE-2012-0038

CVE-2012-0038 affects the Linux kernel prior to 3.1.9. An integer overflow in fs/xfs/xfs_acl.c (xfs_acl_from_disk) can be triggered by a malformed ACL on a filesystem, leading to a heap-based buffer overflow and a local-denial-of-service (panic). A fix was released in 3.1.9. Users should upgrade ...

CVE-2012-6537

CVE-2012-6537 affects the Linux kernel (before 3.6) in net/xfrm/xfrm_user.c where certain structures are not initialized, enabling local users with CAP_NET_ADMIN to leak sensitive kernel memory. The vulnerability is a local information disclosure through kernel memory exposure. Affected component...

CVE-2012-6547

CVE-2012-6547 is the Linux kernel issue where __tun_chr_ioctl in drivers/net/tun.c may leave a structure uninitialized, enabling local users to read kernel stack memory. It is described as affecting Linux kernels prior to 3.6; MiracleLinux advisories list this CVE among others in kernel packages ...

CVE-2014-9710

CVE-2014-9710 affects the Linux kernel’s Btrfs xattr handling prior to 3.19. The vulnerability arises because the visible xattr state may not be consistent with a requested replacement, enabling local attackers to bypass ACLs and gain privileges through standard filesystem operations during an xa...

CVE-2014-9728

CVE-2014-9728 concerns the Linux kernel UDF filesystem before 3.18.2, where missing validation of certain lengths in fs/udf/inode.c and fs/udf/symlink.c can enable a local attacker to trigger a denial of service via a crafted UDF image, potentially causing a buffer over-read and system crash. The...

CVE-2015-4692

CVE-2015-4692 affects the Linux kernel’s KVM code: in arch/x86/kvm/lapic.h, the kvm_apic_has_events() function may dereference a NULL pointer via an ioctl to /dev/kvm, enabling a local attacker to cause a denial of service (system crash). The description indicates the issue exists through kernel ...

CVE-2017-16528

CVE-2017-16528 affects the Linux kernel: sound/core/seq_device.c prior to version 4.13.4. A crafted USB device can trigger a use-after-free in snd_rawmidi_dev_seq_free , causing local DoS and potential system crash. Impact is described as high for confidentiality, integrity, and availability in t...

CVE-2017-16648

CVE-2017-16648 affects the Linux kernel, specifically the dvb_frontend_free function in drivers/media/dvb-core/dvb_frontend.c, up to kernel 4.13.11. The issue is a use-after-free in the DVB frontend management path that can be triggered by a crafted USB device, enabling local users to cause a den...

CVE-2017-5549

CVE-2017-5549 affects the Linux kernel prior to 4.9.5. The vulnerability exists in klsi_105_get_line_state (drivers/usb/serial/kl5kusb105.c) where, on a failure to read the line status, uninitialized heap memory contents are placed into a log entry. This can allow a local attacker to read sensiti...

CVE-2018-10840

CVE-2018-10840 describes a heap-based buffer overflow in the Linux kernel’s ext4 xattr handling: fs/ext4/xattr.c:ext4_xattr_set_entry(). An attacker could exploit this by operating on a mounted crafted ext4 image, potentially leading to kernel memory corruption. Connected feeds confirm multiple v...

CVE-2020-35513

CVE-2020-35513 describes a flaw in the Linux kernel NFS implementation where an incorrect umask during file/directory modification can be triggered when NFSv4.2 and a non-NFSv4.2 process access the NFS concurrently. The result is resource starvation leading to denial of service. The initial and c...

CVE-2021-47026

CVE-2021-47026 — Linux kernel (RDMA/rtrs-clt): The issue arises in the rtrs_clt_remove_path_from_sysfs path where, after removing a session from the active list, the code destroys sysfs interfaces. This ordering can allow a use-after-free scenario where concurrent code (e.g., rtrs_clt_request, ge...

CVE-2021-47345

Concrete details found: CVE-2021-47345 affects the Linux kernel’s RDMA/cma path, specifically a memory leak in rdma_resolve_route() when called repeatedly on the same rdma_cm_id. The trigger described in multiple sources is that cma_query_handler() may cause RDMA_CM_EVENT_ROUTE_ERROR, returning t...

CVE-2022-40476

CVE-2022-40476: A NULL pointer dereference in fs/io_uring.c of the Linux kernel prior to 5.15.62 allows a local user to crash the system or potentially cause a denial of service. Affected software: Linux kernel (pre-5.15.62). Root cause: NULL pointer dereference in io_uring handling. Impact: loca...

CVE-2022-48699

The CVE-2022-48699 issue affects the Linux kernel sched/debug path, where a dentry is leaked by using debugfs_remove(debugfs_lookup()) in update_sched_domain_debugfs. The root cause is improper dentry reference counting, which can, under hotplug stress, lead to memory exhaustion. The available fi...

CVE-2022-48949

The CVE-2022-48949 issue affects the Linux kernel igb driver handling VF resets. When a MAC address is not assigned to a VF, the mailbox message portion sent to the VF is not initialized, and the memory backing the message is taken from the stack, potentially leaking information to the VM. The vu...

CVE-2022-48980

CVE-2022-48980: In the Linux kernel, a bound-check bug in sja1105_init_l2_policing() can cause an out-of-bounds write to the L2 policing table when handling multicast policers on SJA1105. The code computes the multicast policer index as 99 + SRCPORT and compares it to max_entry_count, but for por...

CVE-2022-49055

CVE-2022-49055 : In the Linux kernel, the drm/amdkfd code fixes a null-pointer dereference risk by validating the return value of kmalloc_array(). The vulnerable path could dereference event_waiters[i].wait if kmalloc_array() returns NULL. The fix adds a NULL check before using the allocated memo...

CVE-2022-49318

CVE-2022-49318 pertains to the Linux kernel f2fs subsystem. The vulnerability arises when Syzbot-triggered WARN_ONs in f2fs_is_valid_blkaddr (and __is_bitmap_valid) are triggered for DATA_GENERIC_ENHANCE or DATA_GENERIC_ENHANCE_READ when blkaddr is out of the expected range. The issue was resolve...

CVE-2022-49455

CVE-2022-49455 (Linux kernel) fixes a double-free bug in ocxl_file_register_afu: info_release() could be invoked during device_unregister() when info->dev’s refcount was 0, making an extra ocxl_afu_put()/kfree() unnecessary. The patch adds free_minor() and returns to the err_unregister path to...

CVE-2022-49491

CVE-2022-49491 affects the Linux kernel driver path drm/rockchip vop. Public details confirm a null-pointer dereference in resource_size() when platform_get_resource() returns NULL. The root cause is a sequencing issue: resource_size() must be invoked after devm_ioremap_resource() to ensure res i...

CVE-2023-2019

CVE-2023-2019 : A flaw in the Linux kernel netdevsim device driver’s event scheduling due to improper management of a reference count. This can enable a local attacker to cause a denial-of-service on the system. The description and references in the connected docs point to a kernel-level issue; n...

CVE-2023-20848

The CVE-2023-20848 entry concerns an out-of-bounds read in imgsys_cmdq caused by missing valid range checking, enabling local escalation of privileges with user interaction required. Documented impact is high for confidentiality/integrity/availability, and a patch ID (ALPS07340433) is noted as th...

CVE-2023-52596

CVE-2023-52596: Linux kernel sysctl out-of-bounds access when registering empty sysctl directories. Root cause: a check tests the first element of ctl_table for a permanently empty directory, leading to out-of-bounds. Mitigation in the patched code: register_sysctl_mount_point now passes a ctl_ta...

CVE-2023-52732

In the Linux kernel, CVE-2023-52732 relates to Ceph when a corrupted snap trace is received by the kclient. The patch implements blocking of all further IO/MDS requests and eviction of the kclient to avoid further IOs on potentially inconsistent MDS state, preventing corrupted contents. The root ...

CVE-2023-52851

The CVE-2023-52851 entry concerns the Linux kernel, specifically the mlx5/IB stack. Affected component: mlx5 mkey cache initialization and related UMR/IB registration cleanup paths in mlx5_ib_stage_post_ib_reg_umr_init, mlx5r_umr_resource_cleanup, and __mlx5_ib_add. Root cause: in mlx5_mkey_cache...

CVE-2023-52976

CVE-2023-52976 – Linux kernel : The vulnerability occurs in efi_mem_reserve_persistent when dereferencing the result of memremap while iterating a linked list, if memremap returns NULL. The patch adds a NULL check and falls back to allocating a new page when memremap fails, mitigating potential N...

CVE-2023-53036

CVE-2023-53036 relates to the Linux kernel's DRM/amdgpu stack. On GPUs with RAS enabled, there is a call trace warning and potential hang during device shutdown due to a vulnerability in the amdgpu_vram_mgr_fini path that can propagate through amdgpu_ttm_fini, amdgpu_bo_fini, and related release ...

CVE-2023-53087

CVE-2023-53087 involves the Linux kernel (drm/i915/active) where a race in barrier processing could cause list corruption and oopses when using i915 perf with multiple graphics applications. Root cause: misused non-idle barriers as fence trackers during concurrent barrier preallocate/acquire and ...

CVE-2024-26648

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix variable deferencing before NULL check in edp_setup_replay() In edp_setup_replay(), 'struct dc *dc' & 'struct dmub_replay *replay'was dereferenced before the pointer 'link' & 'replay' NULL check. Fixes the be...

CVE-2024-26681

CVE-2024-26681 is a Linux kernel vulnerability affecting the netdevsim driver. The issue arises in nsim_dev_trap_report_work() where failure to grab a mutex could lead to a loop/backtrace scenario, potentially impacting system stability. The vulnerability details are grounded in a kernel trace an...

CVE-2024-26749

CVE-2024-26749 concerns the Linux kernel USB CDNS3 gadget path. The issue was a memory-use-after-free in cdns3_gadget_ep_disable(), where priv_req is freed via cdns3_gadget_ep_free_request() but list_del_init(&priv_req->list) used priv_req->list after it had been freed, triggering a use-aft...

CVE-2024-26787

Technical details about CVE-2024-26787 are not provided in the supplied documents. Monitor official advisories for updates on affected products, impact, and fixes.

CVE-2024-26829

CVE-2024-26829 : Linux kernel vulnerability in media: ir_toy where a memleak could occur if the command path and irtoy_tx allocation are used and the command fails; the leak is mitigated by freeing the allocated buffer (buf) when irtoy_command fails. Connected advisories confirm the issue and des...

CVE-2024-26916

In the Linux kernel, CVE-2024-26916 is tied to the drm/amd gfxoff handling during suspend. Reverting earlier gfxoff flush logic allowed GFXOFF control to be exercised again on suspend, which can trigger SDMA traffic and lead to system deadlocks when suspending from GNOME. The fix is the revert of...

CVE-2024-27432

CVE-2024-27432 affects the Linux kernel net: ethernet: mtk_eth_soc (MTK PPE) where PPE could hang when disabling during reboot due to PPE scan mode not being disabled first. A patch in MediaTek’s GPL SDK fixes this by disabling PPE scan mode before PPE shutdown. The advisory notes explicit root c...

CVE-2024-35813

CVE-2024-35813 affects the Linux kernel MMC core. The issue arises when accessing an array of idatas in the MMC close-ended ffu path, where prev_idata = idatas[i - 1] is performed without verifying that i > 0, enabling a negative/index-out-of-bounds access. The vulnerability is resolved by add...

CVE-2024-35851

CVE-2024-35851 affects Linux kernel Bluetooth (qca): NULL pointer dereference when waking up non-serdev Qualcomm ROME controllers during suspend due to a missing sanity check on the HCI UART serdev pointer. The fix adds a NULL-pointer check to prevent wakeup() from dereferencing a NULL in suspend...

CVE-2024-35972

The CVE refers to a Linux kernel memory-leak in bnxt_en during bnxt_rdma_aux_device_init(), triggered when ulp = kzalloc() fails and the edev is not assigned to the cleanup path. The fix assigns the allocated edev immediately after kzalloc(), preventing leaks on error paths. Impact is memory leak...

CVE-2024-35977

CVE-2024-35977 : In the Linux kernel, a race in cros_ec_uart caused a NULL pointer dereference in serdev handling when devm_serdev_device_open() was called before serdev->ops were set. The crash path involves the code path that dereferences serdev->ops->receive_buf if serdev is present b...

CVE-2024-36026

CVE-2024-36026 affects the Linux kernel DRM/AMD PM path (drm/amd/pm). The issue causes random hangs during S4 stress tests when using SMU v13.0.4/11, as GC/RLC/PMFW can enter an invalid state and trigger hard hangs. A workaround implemented in the patch adds a GFX reset just before sending the MP...

CVE-2024-38606

CVE-2024-38606 in the Linux kernel relates to the crypto/qat path where adf_send_admin_tl_start() loads a slice_cnt array from FW and tl_print_dev_data() reports statistics via debugfs. If the FW returns an unexpected slice count, the code could read beyond the allocated buffer, potentially trigg...

CVE-2024-38610

The CVE-2024-38610 entry concerns a Linux kernel issue in the acrn_vm_ram_map() path of the ACRN driver. The root cause is flawed follow_pte() usage that can access PFNs incorrectly: (1) it did not verify PTE write permissions (now checked against ACRN_MEM_ACCESS_WRITE); (2) it did not reject ref...

CVE-2024-40968

CVE-2024-40968 affects the Linux kernel on MIPS/Octeon systems. The issue was that after a PCIe link surprise down, the standard PCIe config interface could be abused to cause a kernel panic (“Data bus error”) when accessing peripheral PCIe devices. The fix adds a PCIe link status check and, when...