CVE-2024-44959

The CVE-2024-44959 entry concerns the Linux kernel tracefs component. It describes a root cause in the in-kernel memory reclaim path where structure layout randomization of struct inode can cause overlapping or misused RCU fields during freeing, potentially triggering list corruption (list_del) a...

CVE-2024-46728

CVE-2024-46728 affects the Linux kernel (drm/amd/display) where there is a fix for using aux_rd_interval: the value of aux_rd_interval (size 7) must be checked before use. The connected Azure/Linux Nessus entries confirm the advisory references this vulnerability and describe the fix as preventin...

CVE-2024-47658

CVE-2024-47658 affects the Linux kernel crypto: stm32/cryp. The issue occurs when finalize is called with BH disabled in interrupt mode, causing a spinlock recursion warning and a potential reliability impact. The documented root cause is BH must be disabled during finalize, with the vulnerabilit...

CVE-2024-47716

CVE-2024-47716 affects the Linux kernel on ARM where vfp: Use asm volatile in fmrx/fmxr macros fixes floating-point instructions from userspace that could crash arm kernels. The issue is demonstrated by a minimal userspace reproducer on a Raspberry Pi Zero W and is triggered when the kernel is bu...

CVE-2024-49979

CVE-2024-49979 concerns the Linux kernel TCP GSO fraglist handling. The issue arises when TK fraglist SKBs are composed of a head_skb (headers + first gso_size) and one or more frag_list SKBs (one segment each) where data can be modified by datapath hooks (e.g., NAT/BPF), breaking invariants. In ...

CVE-2024-50149

CVE-2024-50149 : In the Linux kernel, the drm/xe path had a repair for freeing a job during TDR, which could cause a use-after-free because TDR may run the run_job thread. The fix prevents freeing the job in TDR and instead queues it (or lets the scheduler free it). A patch was cherry-picked into...

CVE-2024-50174

Technical details about CVE-2024-50174 are not publicly provided in the supplied documents beyond the high-level description. Monitor for updates from vendors.

CVE-2024-50291

CVE-2024-50291 : In the Linux kernel, the DVB core function dvb_vb2_expbuf() did not validate the buffer index, potentially enabling a local fault. The fix adds a check for a valid buffer index. Affected component: media/dvb-core (kernel). Impact/mitigation: per the provided description, the issu...

CVE-2024-56563

CVE-2024-56563: In the Linux kernel, the ceph MDS cred-check path leaks credentials due to get_current_cred() refcount increment without a matching put_cred() in ceph_mds_check_access(). Impact is confidentiality HIGH; exploit would be local with LOW privileges and no user interaction. The issue ...

CVE-2024-56750

CVE-2024-56750 : Linux kernel — erofs filesystem vulnerability. The issue occurs when mounting file-backed filesystems with an EROFS block size smaller than PAGE_SIZE, where EROFS previously called sb_set_blocksize() and could panic if bdev-backed mounts were not used. The fix directly adjusts s_...

CVE-2024-57950

The CVE-2024-57950 entry concerns the Linux kernel drm/amd/display path, where a defect caused denominators used in calculations to potentially be uninitialized or set to zero, risking division by zero. The resolved description states the fix: initialize denominator defaults to 1 to avoid DIVIDE_...

CVE-2025-21886

CVE-2025-21886 summary (Linux kernel) This vulnerability affects the mlx5 RDMA path. The issue is related to implicit MR management during deregistration: on entering destroy_unused_implicit_child_mr(), the parent implicit MR’s refcount is incremented with refcount_inc_not_zero(), but a correspon...

CVE-2025-21890

Technical details about CVE-2025-21890 are not publicly disclosed in the provided connected documents. The initial description notes a fix in the Linux kernel idpf driver, but further specifics (affected versions, exploitability, mitigations) are not included here. Monitor for updates.

CVE-2025-21982

CVE-2025-21982 affects the Linux kernel’s pinctrl nuvoton npcm8xx GPIO firmware path. The issue stems from devm_kasprintf() potentially returning NULL on failure, with the NULL return not being checked in npcm8xx_gpio_fw(), leading to a kernel NULL pointer dereference. A fix adds a NULL-check in ...

CVE-2025-22028

CVE-2025-22028 affects the Linux kernel media/v4l2 subsystem, specifically the vimc video capture path. The issue arises in vimc_streamer_pipeline_terminate() where .s_stream() could be invoked for subdevs that were not started or are stopped. The root cause is an unnecessary .s_stream() operatio...

CVE-2025-37905

CVE-2025-37905 affects the Linux kernel in the firmware: arm_scmi subsystem, where destroying SCMI devices via device_find_child() creates an unbalanced device refcount because device_find_child() performs an implicit get_device(). This prevents release methods from running during destruction, ca...

CVE-2025-37937

CVE-2025-37937 refers to a Linux kernel vulnerability in the objtool/media path for the dib8000 DVB frontend. The issue occurs when dib8000_set_dds() calls dib8000_read32() and receives zero, causing a divide-by-zero. The kernel fix prevents this division by zero, addressing an UBSAN warning seen...

CVE-2025-37979

CVE-2025-37979 affects the Linux kernel ASoC: qcom sc7280 LPASS driver. A commit introduces case values in the sc7280 lpass driver (e.g., RX_CODEC_DMA_RX_0 in sc7280_snd_hw_params) that can trigger out-of-bounds accesses in driver data arrays. The issue is mitigated by redefining LPASS_MAX_PORTS ...

CVE-2025-37991

CVE-2025-37991 describes a PA-RISC (parisc) Linux kernel issue where a SIGFPE exception can crash an application if a second SIGFPE is delivered in the signal handler. The root cause is traced to glibc using a double-word floating-point store to atomically update function descriptors, causing a t...

CVE-2025-38049

CVE-2025-38049 (Linux kernel) : In x86 resctrl, allocation of the cleanest CLOSID could dereference NULL on platforms without LLC occupancy counters, causing a NULL pointer dereference when creating a new control group. The issue arises from code that searched for the CLOSID with the fewest dirty...

CVE-2025-38268

CVE-2025-38268: In the Linux kernel, a deadlock window existed in the USB Type‑C/TCPM Alt Mode interaction due to an unprotected state check in tcpm_queue_vdm_unlocked, which could allow the Alt Mode driver to grab the TCPM lock while state changes occurred. The fix moves tcpm_queue_vdm_unlocked ...

CVE-2026-31533

The CVE-2026-31533 entry concerns a Linux kernel net/tls use-after-free in tls_do_encryption() when crypto_aead_encrypt() returns -EBUSY. The underlying issue is double cleanup of encrypt_pending and the scatterlist entry due to distinct cleanup paths (async callback tls_encrypt_done() vs synchro...

CVE-1999-0590

Technical details are not publicly available in the provided documents for CVE-1999-0590; no affected products, versions, impact, or remediation are specified. Monitor for updates from the connected sources.

CVE-2009-1298

CVE-2009-1298 affects the Linux kernel: the function ip_frag_reasm in net/ipv4/ip_fragment.c can be triggered by long IP packets due to an incorrect argument passed to IP_INC_STATS_BH. This enables remote attackers to cause a denial of service via a NULL pointer dereference and kernel hang. Affec...

CVE-2009-4138

CVE-2009-4138 affects Linux kernels with the FireWire OHCI driver (drivers/firewire/ohci.c) prior to 2.6.32-git9. In packet-per-buffer mode, a local user can trigger a NULL pointer dereference via an ioctl associated with receiving an ISO packet with a zero payload-length field, potentially leadi...

CVE-2010-4250

CVE-2010-4250 concerns a memory leak in the inotify_init1 path of the Linux kernel’s inotify subsystem (fs/notify/inotify/inotify_user.c) prior to kernel 2.6.37. The issue is triggered by failed attempts to create files, allowing local users to exhaust memory and potentially cause a denial of ser...

CVE-2010-4263

The CVE-2010-4263 issue involves the Intel igb driver (drivers/net/igb/igb_main.c) in the Linux kernel and its handling of VLAN-tagged frames when SR-IOV and promiscuous mode are enabled but no VLANs are registered. In kernels before 2.6.34, processing such frames could trigger a NULL pointer der...

CVE-2010-4347

CVE-2010-4347 affects the Linux kernel’s ACPI subsystem. The vulnerability arises in the debugfs interface (custom_method file) which, due to world-writable 0222 permissions, lets a local user place a custom ACPI method in interpreter tables via acpi_debugfs_init in drivers/acpi/debugfs.c. This c...

CVE-2011-0695

CVE-2011-0695 is a race condition in the Linux kernel’s InfiniBand driver (cm_work_handler in drivers/infiniband/core/cma.c) on 2.6.x. The issue allows remote attackers to trigger a denial of service (panic) by issuing an InfiniBand request while other request handlers are active, causing an inva...

CVE-2011-2183

CVE-2011-2183 targets the Linux kernel’s Kernel SamePage Merging (KSM) feature. When KSM is enabled, a race in scan_get_next_rmap_item in mm/ksm.c can allow a local user to trigger a NULL pointer dereference, potentially crashing the kernel or causing other unspecified impact. Affected: Linux ker...

CVE-2011-3363

The CVE-2011-3363 issue affects the Linux kernel up to version 2.6.38, specifically the setup_cifs_sb function in fs/cifs/connect.c. The root cause is improper handling of DFS referrals, enabling a remote CIFS server to trigger a denial-of-service (system crash) by placing a referral at the root ...

CVE-2011-3637

CVE-2011-3637 is a vulnerability in the Linux kernel where the m_stop function in fs/proc/task_mmu.c can trigger an OOPS via vectors that cause an m_start error. Affected: Linux kernel versions prior to 2.6.39 (i.e., 2.6.38 and earlier). Impact: local denial of service (kernel oops) without remot...

CVE-2012-6712

The CVE-2012-6712 issue affects the Linux kernel prior to 3.4, where a buffer overflow in the Intel Wireless iwlwifi driver (iwl-agn-sta.c) can cause memory corruption. Exploitation details are not provided in the documents, but the vulnerability is documented across multiple feeds with reference...

CVE-2015-8746

CVE-2015-8746 affects the Linux kernel NFS client (fs/nfs/nfs4proc.c). The root cause is that memory is not properly initialized for migration recovery operations in the NFS client, which can be exploited by remote NFS servers to trigger a denial of service via a null pointer dereference and kern...

CVE-2021-46980

The CVE-2021-46980 item concerns Linux kernel USB Type-C UCSI: the code previously retrieved only the first 4 power data objects (PDOs) due to a 16-byte MESSAGE_IN limit. This could cause an out-of-bounds access in ucsi_psy_get_voltage_now() when a PD source advertises more than 4 PDOs (up to 7 a...

CVE-2021-47053

In the Linux kernel, CVE-2021-47053 affects crypto: sun8i-ss where the pad object could leak memory due to several failure return paths not freeing the pad. The issue has been fixed in the kernel (memory leak); patches are available in the linked stableKernel commits. Impact is a resource leak (l...

CVE-2021-47104

The CVE-2021-47104 entry concerns the Linux kernel IB/qib component, specifically a memory leak in qib_user_sdma_queue_pkts(). The root cause is an incorrect goto label used in the error path, which caused cleanup of allocated pkt structures to be skipped, leading to a resource leak. The connecte...

CVE-2021-47293

CVE-2021-47293 affects the Linux kernel net/sched skbmod path. The issue: tcf_skbmod_act() assumed Ethernet at L2, causing silent packet corruption for non‑Ethernet protocols (e.g., CAN vcan devices). Affected scenario shown by examples using vcan0 and skbmod swap mac; fix implemented to skip skb...

CVE-2021-47490

CVE-2021-47490 affects the Linux kernel DRM memory management (drm/ttm). The issue is a memleak during ttm_transfered_destroy, and the fix includes cleanup of fences for ghost objects. The available connected advisories/policy notes confirm the vulnerability is fixed by kernel patches; no exploit...

CVE-2021-47589

In CVE-2021-47589, the Linux kernel igbvf driver contains a double-free / use-after-free path in igbvf_probe. If register_netdev() fails, control flows to err_hw_init then err_ioremap, and free_netdev attempts to clean dev->napi_list entries while adapter->rx_ring (which holds napi) has alr...

CVE-2021-47631

CVE-2021-47631 affects the Linux kernel (ARM: da850-evm path) where a NULL pointer dereference could occur in da850_evm_config_emac() during boot on palmetto-bmc/QEMU setups. The root cause is emac_pdata being NULL because davinci_soc_info is populated only on Davinci machines, while the function...

CVE-2022-20105

CVE-2022-20105 concerns MediaTek MM service vulnerable to a stack-based buffer overflow causing an out-of-bounds write, enabling local privilege escalation with SYSTEM-level execution privileges required by the exploit. All sources consistently describe the flaw as a local, no-user-interaction vu...

CVE-2022-3238

The CVE-2022-3238 entry describes a double-free in the Linux kernel NTFS3 subsystem triggered when remount and unmount occur concurrently, allowing a local user to crash or potentially escalate privileges. Connected documents confirm the issue is in the kernel NTFS3 code path and that the vulnera...

CVE-2022-48789

CVE-2022-48789 concerns an AER-related use-after-free in the Linux kernel’s nvme-tcp transport error_recovery path. The vulnerability arises when nvme_tcp_submit_async_event_work checks ctrl/queue state while scheduling IO work, creating a race with the error_recovery handler that could lead to f...

CVE-2022-48960

The CVE-2022-48960 issue is a Linux kernel use-after-free in net: hisilicon/hix5hd2_rx(), where a skb may be freed by napi_gro_receive() and later dereferenced. The connected sources confirm a fix was applied in the kernel (via stable tree commits referenced in the CVE entry). The vulnerability a...

CVE-2022-48977

The CVE-2022-48977 vulnerability affects the Linux kernel CAN subsystem. It fixes a NULL pointer dereference in can_rcv_filter, triggered by missing initialization of ml_priv in the receive path for CAN frames. The issue arises because dev->type may be ARPHRD_CAN in CAN-capable devices, but so...

CVE-2022-48980

CVE-2022-48980: In the Linux kernel, a bound-check bug in sja1105_init_l2_policing() can cause an out-of-bounds write to the L2 policing table when handling multicast policers on SJA1105. The code computes the multicast policer index as 99 + SRCPORT and compares it to max_entry_count, but for por...

CVE-2022-49055

CVE-2022-49055 : In the Linux kernel, the drm/amdkfd code fixes a null-pointer dereference risk by validating the return value of kmalloc_array(). The vulnerable path could dereference event_waiters[i].wait if kmalloc_array() returns NULL. The fix adds a NULL check before using the allocated memo...

CVE-2022-49085

CVE-2022-49085 affects the Linux kernel’s drbd path, fixing five use-after-free bugs in get_initial_state where skb could be freed and later dereferenced. The issue arises when notify_initial_state_done and subsequent notify_*_state_change calls free skb on error, leading to a use-after-free via ...

CVE-2022-49247

CVE-2022-49247 – Linux kernel media stk1160 issue : The vulnerability concerns the stk1160 driver in the Linux kernel’s videobuf2 path. When start_streaming fails, the driver previously returned all queued buffers with VB2_BUF_STATE_ERROR, but it should have returned them with VB2_BUF_STATE_QUEUE...