CVE-2024-43832

In CVE-2024-43832, the issue is in the Linux kernel's s390/uv path where folio_wait_writeback() could be called without a folio reference after PTL removal, risking use-after-free if a folio is freed concurrently. The root cause is that folio_wait_writeback() requires both no held spinlocks and a...

CVE-2023-53047

CVE-2023-53047 refers to a race condition in the Linux kernel’s AMDTEE path (amdtee_open_session) that can lead to use-after-free when a session is closed concurrently. The official fix is to set the sess->sess_mask bit as the last step in amdtee_open_session to prevent use-after-free after se...

CVE-2024-26748

CVE-2024-26748 (Linux kernel) — Affects the usb cdns3 gadget driver. A memory double-free could occur when handling a zero-length packet that was queued as an extra request. The patch adds a check at line 829 to skip usb_gadget_giveback_request() for this additional zero-length request, avoiding ...

CVE-2024-26771

Linux kernel CVE-2024-26771Fix: The TI edma (dmaengine) driver now includes null-pointer checks in edma_probe to guard against NULL from devm_kasprintf() (which can return NULL on failure). This prevents a potential NULL dereference in the kasprintf allocation path. Patch references in the Linux ...

CVE-2024-26856

CVE-2024-26856 relates to the Linux kernel net driver for Sparx5. A use-after-free occurs when a MAC table entry is removed but still used; the code freed the mac_entry before its vid was used to delete the HW entry. The fix delays freeing until after deleting the hardware entry by first using th...

CVE-2024-36887

CVE-2024-36887 affects the Linux kernel: the e1000e PHY mdic access code originally used usleep_range inside atomic contexts, causing potential kernel panics. A partial revert of a prior workaround reintroduced this by switching usleep_range calls to udelay. The fix is to revert to using usleep_r...

CVE-2024-36916

The CVE-2024-36916 issue is in Linux kernel’s blk-iocost code where iocg->delay can be shifted right by too large a value, triggering UBSAN shift-out-of-bounds: shift exponent 64 is too large for 64-bit u64. Exploitation details are not provided in the documents. The remediation described in t...

CVE-2024-38593

CVE-2024-38593 affects the Linux kernel’s net: micrel: lan8841 timestamp handling. Description: the issue occurred when a port was brought up and then down, because the code started using the ptp workqueue to fetch the second timestamp part. If NETWORK_PHY_TIMESTAMPING is disabled, the ptp_clock ...

CVE-2024-39505

CVE-2024-39505 relates to the Linux kernel drm/komeda code where komeda_pipeline_get_state() may return an error-valued pointer. The fix requires checking the pointer for negative or NULL values before dereferencing. The vulnerability impact is STATED as potential denial of service or corruption ...

CVE-2024-41027

CVE-2024-41027 affects the Linux kernel userfaultfd API. The issue arises when a feature not enabled in kernel config is requested: instead of returning an error, the kernel silently lists all features, potentially triggering a warning (as seen in zap_pte_range mortgage path). The fix is to have ...

CVE-2024-42067

CVE-2024-42067 is a Linux kernel vulnerability where, in the BPF/JIT path, set_memory_rox() may fail and leave memory unprotected. The issue arises because the code does not consistently act on the return value of set_memory_rox() and bpf_jit_binary_lock_ro(), allowing a potential protection gap ...

CVE-2024-42135

CVE-2024-42135 concerns the Linux kernel vhost_task handling of SIGKILL. The connected sources confirm a concrete fix: when a SIGKILL is issued, the kernel now (1) marks the worker as killed to prevent new virtqueue usage and new flush operations, (2) fixes the virtqueue-to-worker mapping to stop...

CVE-2024-43840

CVE-2024-43840 – Linux kernel (arm64, BPF trampoline) : The trampoline code for BPF_TRAMP_F_CALL_ORIG incorrectly used emit_addr_mov_i64(), assuming the bpf_tramp_image address resides in vmalloc() space with 48-bit handling. If the address exceeds 48 bits (e.g., kzalloc’d bpf_tramp_image), the t...

CVE-2024-44943

CVE-2024-44943 relates to the Linux kernel mm/gup code where pinning folio in CMA memory during SEV VM startup could trigger a warning due to misusing try_grab_folio in both fast and slow paths. The issue stems from the longterm pinning check causing fallback paths to also fail, producing a kerne...

CVE-2024-46697

The CVE-2024-46697 issue in the Linux kernel’s nfsd path (nfsd4_fattr_args.context) is fixed: if a goto out path executes before security label checks, an uninitialized args.context on the stack could be freed. The mitigation is to zero/initialize args.context early, preventing a use-after-free/M...

CVE-2024-46810

CVE-2024-46810 affects the Linux kernel UI path for displays: the drm/bridge tc358767 code may signal HPD events via IRQ before the connector is fully initialized, risking a NULL pointer dereference. The connected documents confirm a fix was applied by ensuring the connector is fully initialized ...

CVE-2024-46845

CVE-2024-46845 (Linux kernel): The timerlat use-after-free occurs when a SIGTERM kills user-space tracing threads, causing an hrtimer to be freed twice during thread shutdown. The documented fix cancels the hrtimer only if the associated thread still exists and adds an interface_lock around tlat_...

CVE-2024-47658

CVE-2024-47658 affects the Linux kernel crypto: stm32/cryp, where the finalize operation in interrupt context could trigger a spinlock recursion warning if BH is not properly disabled. The OSV entries show concrete remediation: Root has patched CVE-2024-47658 in the linux package for Root:Ubuntu:...

CVE-2024-50281

CVE-2024-50281 affects the Linux kernel’s key management component, specifically the trusted: dcp path. The vulnerability stems from sealing/unsealing a key blob where the AEAD cipher operation is submitted but not waited for, allowing a race that can lead to a NULL pointer dereference in the DCP...

CVE-2024-50289

CVE-2024-50289 concerns the Linux kernel media/av7110 driver (av7110_ca.c) with a spectre-related flaw reported by the smatch tool in dvb_ca_ioctl() for av7110->ci_slot. The issue was fixed in the kernel through the patches referenced (e.g., git.kernel.org stable commits 458ea1c0... and f39272...

CVE-2025-21661

CVE-2025-21661 concerns the Linux kernel GPIO virtuser path (gpio-virtuser.c). When a virtuser device is created via configfs and probe fails due to an incorrect lookup table, the table was not cleaned up, blocking subsequent probes and potentially requiring device release to recover. A memory le...

CVE-2025-21783

CVE-2025-21783 affects the Linux kernel gpiolib: gpiochip_get_ngpios() uses chip_() macros that assume gpiodev is initialised. When called via bgpio_init(), these macros can crash with a NULL pointer dereference. The fix replaces chip_ () with the corresponding dev_() macros to prevent the crash....

CVE-2025-22043

The CVE-2025-22043 entry concerns the Linux kernel ksmbd component where a missing bounds check in the durable handle context was fixed. Affected area: ksmbd’s durable handle context in the SMB server code (fs/smb/server/smb2pdu.c). Cause: missing bounds check allowing operations outside the buff...

CVE-2025-22059

Technical details beyond what is provided in the initial document are not publicly available in the connected documents. Monitor for updates from vendors and security advisories.

CVE-2025-37764

CVE-2025-37764 affects the Linux kernel (drm/imagination/powervr): a vulnerability causing firmware memory leaks during firmware image processing, leading to leaks on module unload and in failure paths during module load. The fix releases memory used for firmware image processing results and dest...

CVE-2025-37842

CVE-2025-37842 affects the Linux kernel and is resolved by upgrading to kernel versions >= 6.6.112.1-2 (as noted by Mariner/Astra/SUSE advisories). Technical details from connected docs indicate the issue arises in the spi/fsl-qspi driver cleanup path: the driver previously used a legacy remov...

CVE-2025-37926

CVE-2025-37926 concerns the Linux kernel’s ksmbd component. A_use-after-free can occur due to a race between ksmbd_session_rpc_open() and __session_rpc_close(), potentially allowing exploitation when an attacker could trigger a session race. The fix adds a lock (rpc_lock) to the session to protec...

CVE-2025-37969

In CVE-2025-37969, the Linux kernel vulnerable component is the IIO IMU driver st_lsm6dsx (read_tagged_fifo). The issue allows a potential lockup when pattern_len is zero and the device FIFO is not empty, risking an infinite loop and elevated availability impact. The vulnerability has been fixed ...

CVE-2025-38110

The CVE-2025-38110 issue affects the Linux kernel net/mdiobus path. It describes insufficient verification of ioctl parameters when performing Clause 45 (C45) read/write operations via mdiobus, allowing an address value beyond PHY_MAX_ADDR (32) to be passed and potentially enabling out-of-bounds ...

CVE-2025-38298

CVE-2025-38298 corresponds to a Linux kernel EDAC issue (EDAC/skx_common) where reloading i10nm_edac after unloading and reloading can trigger a general protection fault. The root cause was that the adxl_component_count variable, which tracks ADXL components, was not reset during the reload seque...

CVE-2026-31589

The CVE-2026-31589 issue affects the Linux kernel memory management in the mm path related to folio_unmap_invalidate. The vulnerability arises when the system calls free_folio() directly, instead of loading the free_folio function pointer after obtaining a mapping reference or lock, potentially l...

CVE-2026-46289

In the Linux kernel, CVE-2026-46289 concerns bugs in lib/scatterlist during extract_kvec_to_sg when transferring data from a kvec to a sglist. The main issues: (1) the computed length for a sglist entry can exceed the page size, causing overread; (2) while extracting a user buffer, the sglist can...

CVE-2006-2935

CVE-2006-2935 affects the Linux kernel starting with 2.2.16 and later, where the dvd_read_bca function in the DVD handling code (drivers/cdrom/cdrom.c) assigns the wrong value to a length variable, enabling a local user to trigger a buffer overflow via a crafted USB Storage device and execute arb...

CVE-2008-1375

CVE-2008-1375 describes a race condition in the Linux kernel’s directory notification subsystem (dnotify). It affects Linux kernel 2.6.x before 2.6.24.6, and 2.6.25 before 2.6.25.1. Successful exploitation could allow local users to cause a denial of service (OOPS) and possibly gain privileges vi...

CVE-2009-0269

CVE-2009-0269 refers to a local kernel vulnerability in the Linux kernel’s eCryptfs inode handling. The flaw, described as a readlink error path in fs/ecryptfs/inode.c, can lead to denial of service (fault or memory corruption) and possibly other unspecified effects by causing the code to use a -...

CVE-2009-3620

CVE-2009-3620 affects the ATI Rage 128 (r128) driver in the Linux kernel, where the driver fails to properly verify Concurrent Command Engine (CCE) state initialization. This local vulnerability can cause a NULL pointer dereference and system crash (DoS) and may allow privilege escalation via uns...

CVE-2009-3889

CVE-2009-3889 affects the Linux kernel megaraid_sas driver; the dbg_lvl file is world-writable in kernels before 2.6.27, enabling local users to modify driver behavior and logging level. MiracleLinux AXSA:2010-141 references this issue among others and indicates a fix in kernel 2.6.27+ as part of...

CVE-2010-0622

CVE-2010-0622 affects the Linux kernel’s wake_futex_pi path in kernel/futex.c. The advisory notes that kernels before 2.6.33-rc7 fail to handle certain unlock operations for Priority Inheritance futexes, allowing local users to trigger a denial of service (OOPS) and potentially other impacts via ...

CVE-2011-3209

CVE-2011-3209 affects the Linux kernel on x86 prior to 2.6.26. The div_long_long_rem implementation in include/asm-x86/div64.h can trigger a Divide Error Fault and system panic when clock_gettime is invoked by local users, leading to a denial of service. The impact is local, with a complete avail...

CVE-2011-3359

CVE-2011-3359 affects the Linux kernel (pre-2.6.39), specifically the b43 wireless driver. The dma_rx path does not allocate receive buffers properly, enabling remote attackers to crash the system via a crafted frame (DoS). Affected code is in drivers/net/wireless/b43/dma.c. Remediation: upgrade ...

CVE-2012-3430

CVE-2012-3430 : In the Linux kernel before 3.0.44, the function rds_recvmsg in net/rds/recv.c fails to initialize a structure member, allowing a local attacker to read potentially sensitive kernel stack memory via recvfrom or recvmsg on an RDS socket. Impact: information disclosure. Affected: Lin...

CVE-2012-4508

CVE-2012-4508 is a race condition in the Linux kernel's ext4 extents handling (fs/ext4/extents.c) that, before version 3.4.16, allows a local unprivileged user to read data from a deleted file by reading an extent that isn’t properly marked uninitialized. The issue is fixed in the 3.4.16 update (...

CVE-2013-0268

The CVE-2013-0268 issue affects the Linux kernel, specifically the msr_open function in arch/x86/kernel/msr.c, vulnerable before version 3.7.6. The vulnerability allows local unprivileged users to bypass capability restrictions and gain root by running a crafted application (msr32.c). Affected co...

CVE-2013-0913

CVE-2013-0913 affects the i915 DRM driver in the Linux kernel up to version 3.8.3. The vulnerability is an integer overflow in drivers/gpu/drm/i915/i915_gem_execbuffer.c, which can be triggered by a crafted relocation-copy sequence and may lead to a heap-based buffer overflow, potentially enablin...

CVE-2013-1773

CVE-2013-1773 involves a buffer overflow in the Linux kernel VFAT UTF-8 to UTF-16 conversion during a VFAT write when utf8 mount option is used. Affects Linux kernel before 3.3; local privilege escalation or system crash possible. The connected advisory set includes references to kernel patches (...

CVE-2013-7264

The CVE-2013-7264 issue affects the Linux kernel up to version 3.12.3, specifically the l2tp_ip_recvmsg function in net/l2tp/l2tp_ip.c. The vulnerability arises because a length value is updated before ensuring that the associated data structure is initialized, enabling a local attacker to leak k...

CVE-2014-4611

CVE-2014-4611 concerns an integer overflow in the LZ4 implementation used in Yann Collet LZ4 prior to r118 and in the Linux kernel’s lz4_decompress.c (linux kernel before 3.15.2) on 32-bit platforms. A crafted Literal Run can trigger improper handling, enabling context-dependent attackers to caus...

CVE-2014-9922

CVE-2014-9922 affects the Linux kernel’s eCryptfs subsystem, where the combination of eCryptfs and an overlayfs stack can let a local user gain privileges. The issue is triggered by a vulnerability in fs/ecryptfs/main.c and fs/overlayfs/super.c, with impact described as local privilege escalation...

CVE-2015-4004

The CVE-2015-4004 issue affects the OZWPAN driver in the Linux kernel up to version 4.0.5. The flaw stems from parsing crafted packets using an untrusted length field, allowing remote attackers to read kernel memory (information disclosure) or trigger a denial of service (out-of-bounds read and s...

CVE-2015-4036

CVE-2015-4036: An array index error in Linux kernel before 4.0 in drivers/vhost/scsi.c (tcm_vhost_make_tpg, renamed to vhost_scsi_make_tpg) can allow local guest OS users to cause a denial of service (memory corruption) or potentially other impact via a crafted VHOST_SCSI_SET_ENDPOINT IOCTL. Expl...