CVE-2010-0410

CVE-2010-0410 affects the Linux kernel up to version 2.6.32.7, via drivers/connector/connector.c, allowing local users to cause memory exhaustion and a system crash by flooding NETLINK_CONNECTOR messages. The MiracleLinux advisories (AXSA:2010-285:05 and AXSA:2010-323:11) explicitly include CVE-2...

CVE-2010-1084

CVE-2010-1084 affects Linux kernel 2.6.18–2.6.33 (and possibly other versions); vulnerability arises from memory corruption triggered by a large number of Bluetooth sockets, related to sysfs file sizing in net/bluetooth/l2cap.c, net/bluetooth/rfcomm/core.c, net/bluetooth/rfcomm/sock.c, and net/bl...

CVE-2010-2955

The CVE-2010-2955 issue affects the Linux kernel before 2.6.36-rc3-next-20100831, specifically the cfg80211_wext_giwessid function in net/wireless/wext-compat.c, which fails to initialize certain structure members. This enables a local attacker to exploit an off-by-one error in ioctl_standard_iw_...

CVE-2010-3861

CVE-2010-3861 affects the Linux kernel up to version 2.6.36. The vulnerability arises in the ethtool_get_rxnfc function in net/core/ethtool.c, which fails to initialize a certain block of heap memory. This can allow a local user to obtain potentially sensitive information via an ETHTOOL_GRXCLSRLA...

CVE-2011-0714

CVE-2011-0714 affects the Linux kernel 2.6.32 as patched for Red Hat Enterprise Linux 6, specifically involving the RPC server sockets functionality. The use-after-free vulnerability is triggered in a Red Hat patch related to lockd and the svc_xprt_received path, allowing remote attackers to cras...

CVE-2011-2491

The CVE-2011-2491 issue affects the Linux kernel’s NFS client NLM protocol implementation. It allows a local attacker to cause a denial of service (system hang) by abusing a LOCK_UN flock system call. The vulnerability is rooted in the NLM handling in the kernel prior to 3.0. The referenced fix/c...

CVE-2012-4444

The CVE-2012-4444 issue affects the Linux kernel prior to 2.6.36, where the ip6_frag_queue function in net/ipv6/reassembly.c can be exploited remotely to bypass certain network restrictions by sending overlapping IPv6 fragments. The vulnerability is consistently described in multiple sources (Lin...

CVE-2012-6537

CVE-2012-6537 affects the Linux kernel (before 3.6) in net/xfrm/xfrm_user.c where certain structures are not initialized, enabling local users with CAP_NET_ADMIN to leak sensitive kernel memory. The vulnerability is a local information disclosure through kernel memory exposure. Affected component...

CVE-2013-1827

CVE-2013-1827 affects the Linux kernel: net/dccp/ccid.h before 3.5.4. It allows local privilege escalation or denial of service (NULL pointer dereference and system crash) via CAP_NET_ADMIN on a getsockopt call (sender or receiver). The connected advisories/bulletins (Unity/Linux Nessus entries) ...

CVE-2013-4163

CVE-2013-4163 affects the Linux kernel IPv6 path (ip6_output.c: ip6_append_data_mtu). The bug stems from not correctly tracking whether IPV6_MTU was set via setsockopt, enabling local attackers to crash the system by crafting a UDP_CORK-reliant application. Impact is local denial of service/OS cr...

CVE-2013-7270

The CVE-2013-7270 issue affects the Linux kernel prior to 3.12.4, where packet_recvmsg in net/packet/af_packet.c updates a length value before initializing an associated data structure. This can enable local attackers to read kernel memory via recvfrom, recvmmsg, or recvmsg. Remediation is to upg...

CVE-2015-2877

CVE-2015-2877 affects Kernel Samepage Merging (KSM) in Linux kernels 2.6.32–4.x. The write-timing side channel allows a guest OS user to defeat ASLR on other guest instances via Cross-VM ASL Introspection (CAIN). The entry notes that disabling deduplication mitigates the attack vector. No explici...

CVE-2018-12929

CVE-2018-12929 concerns the Linux kernel ntfs_read_locked_inode vulnerability in ntfs.ko on kernel 4.15.0, which can trigger a use-after-free read and potentially cause a denial of service (kernel oops or panic) via a crafted NTFS filesystem. The available documents confirm the CVE ID and the aff...

CVE-2021-46986

CVE-2021-46986: Linux kernel dwc3 gadget code flaw where freeing the gadget structure before endpoints are freed caused use-after-free/dangling-pointer issues. The description explains that dwc3_gadget_release() frees dwc->gadget upon device removal, but endpoints created by dwc3_gadget_init_e...

CVE-2021-47057

CVE-2021-47057 relates to the Linux kernel crypto: sun8i-ss, where a memory leak occurred when dma_iv mapping failed. The defect occurred on the error path where object d’s memory was not freed prior to returning. The fix adds an error-return label and ensures d is freed before exit. This CVE ent...

CVE-2021-47112

CVE-2021-47112 affects the Linux kernel’s x86/kvm PV features (Async PF, PV EOI, steal time) used with hypervisors. The issue is that these PV features share memory with the hypervisor, and after hibernation the kernel must teardown all such features to prevent the hypervisor from writing to stal...

CVE-2021-47124

CVE-2021-47124 concerns the Linux kernel io_uring subsystem: a race with linked timeouts can lead to an extra reference being released, risking a use-after-free in the linked timeout handling path. The root cause is a mismatch in reference counting between io_put_req() and deferred release during...

CVE-2021-47181

The CVE-2021-47181 issue affects the Linux kernel code path for usb: musb: tusb6010. The root cause is a missing NULL check after platform_get_resource(), which can lead to a NULL pointer dereference if platform_get_resource() returns NULL. Public sources describe the vulnerability and impact as ...

CVE-2021-47434

CVE-2021-47434 concerns the Linux kernel xHCI host controller where command ring pointer corruption could occur while aborting a command. The issue arises because the 64-bit CRCR is written in two 32-bit writes; when the upper 32 bits are not updated (they may remain zero) due to the command ring...

CVE-2021-47632

CVE-2021-47632 affects the Linux kernel on PowerPC where a spin_lock in change_page_attr() for set_memory caused spinlock recursion. The fix removes the read/modify/write sequence and the spin_lock(), and uses atomic handling of page-flag sets (_PAGE_KERNEL_RO/ROX/RW/RWX) by comparing flag sets t...

CVE-2021-47670

CVE-2021-47670 (can: peak_usb) is a use-after-free in the Linux kernel can subsystem. After peak_usb_netif_rx_ni(skb) is called, the skb may be dereferenced, and the can_frame cf that aliases skb memory can access memory that has been freed. The issue is resolved by reordering code lines to preve...

CVE-2022-0646

The CVE-2022-0646 issue affects the Linux kernel MCTP subsystem, caused by a use-after-free in the code path involving cancel_work_sync after unregister_netdev during device removal. It targets Linux Kernel 5.17-rc1 through 5.17-rc5, enabling a local attacker to crash the system or escalate privi...

CVE-2022-48799

CVE-2022-48799 corresponds to a Linux kernel perf subsystem issue: list corruption in perf_cgroup_switch() affecting the cgrp_cpuctx_list during event removal. The root cause is a risky iteration over a list while removing entries; the recommended fix is to replace list_for_each_entry with list_f...

CVE-2022-48961

CVE-2022-48961 is a Linux kernel vulnerability affecting the MDIO subsystem. The issue is an unbalanced fwnode reference count in mdio_device_release(), caused by a missing fwnode_handle_put() in normal paths after fwnode_handle_get() during of_mdiobus_register_device() binding. The leak manifest...

CVE-2022-49000

CVE-2022-49000 – Linux kernel (iommu/vt-d) refcount leak fix . The issue stems from for_each_pci_dev() implemented via pci_get_device(); the returned pci_dev’s reference count is incremented, but input dev is not always decremented, leading to a potential refcount leak. The patch adds a pci_dev_p...

CVE-2022-49138

CVE-2022-49138 in the Linux kernel Bluetooth hci_event path caused memory corruption when multiple conn complete events arrive for the same handle. The vulnerability arises because the device could be registered multiple times for a single connection. The fixes add handling to ignore redundant ev...

CVE-2022-49368

CVE-2022-49368 relates to a Linux kernel out-of-bounds read in net: ethernet: mtk_eth_soc, triggered by an invalid fsp->location that comes from user via ethtool_get_rxnfc(). The vulnerability is fixed by validating the location parameter to prevent the read, with upstream kernel patches refer...

CVE-2022-49447

CVE-2022-49447 concerns the Linux kernel on ARM/HiSilicon where of_find_compatible_node increments the device_node refcount but no corresponding of_node_put was invoked, causing a refcount leak. The fix removes the leak by adding of_node_put after of_find_compatible_node. Affected software is the...

CVE-2022-49501

CVE-2022-49501 concerns the Linux kernel USB Ethernet (usbnet) path. The root cause is a use-after-free risk during disconnect caused by non-mirroring binding/unbinding order: usbnet_probe() binds then register_netdev(), whereas disconnect() previously unregisters before unbind(), leading to PHY ...

CVE-2022-49733

CVE-2022-49733 affects the Linux kernel ALSA: oss subsystem (snd_pcm_oss) with a race in snd_pcm_oss_sync() triggered via SNDCTL_DSP_SYNC. The issue arises because snd_pcm_oss_make_ready() is invoked before acquiring the params_lock, creating a window where another thread can reconfigure the stre...

CVE-2022-49990

CVE-2022-49990 affects the Linux kernel (s390) where guarded storage and runtime instrumentation control blocks stored in thread_struct are copied during fork via arch_dup_task_struct() and then cleared in copy_thread(). If fork() fails after the initial task dup and before copy_thread(), free_ta...

CVE-2022-50136

The CVE-2022-50136 issue affects the Linux kernel RDMA/siw path, where siw_recv_mpa_rr returning -EAGAIN could cause IW_CM_EVENT_CONNECT_REPLY to be reported incorrectly, triggering a kernel call trace (iw_cm) and a BUG at iwcm.c:894. A patch/fix has been applied in kernel code (e.g., commits lin...

CVE-2023-22997

CVE-2023-22997 affects the Linux kernel prior to 6.1.2. The vulnerability resides in module/decompress.c where the function module_get_next_page can return an error pointer, but code treats it as NULL in the error case, potentially causing a denial of service. The issue is local in scope; CVSS in...

CVE-2023-3439

Ava ilable details from connected docs confirm CVE-2023-3439 affects the Linux kernel MCTP implementation. Specifically, mctp_unregister() reclaims a device resource on netcard detach, and a running routine may not notice this, leading to a use-after-free of the mdev->addrs object and a denial...

CVE-2023-35826

CVE-2023-35826 affects the Linux kernel before 6.3.2, with a use-after-free in cedrus_remove (drivers/staging/media/sunxi/cedrus/cedrus.c). The issue is described in the NVD entry and corroborated by related advisories; the root cause is a resource management/use-after-free in the cedrus driver. ...

CVE-2023-52499

The CVE-2023-52499 entry documents a Linux kernel issue on powerpc/47x where a flaw in ret_from_syscall causes 47x syscall return crashes during boot. The root cause, as described, is a faulty branch back after an icache flush, due to commit 6f76a01173cc that removed the 1 label and caused mis-br...

CVE-2023-52855

CVE-2023-52855: Linux kernel USB-DWC2 driver race condition. When _dwc2_hcd_urb_enqueue() and _dwc2_hcd_urb_dequeue() run concurrently, urb->hcpriv can be NULL-checked before urb->hcpriv is assigned NULL, enabling a NULL dereference in dwc2_hcd_urb_dequeue. The connected documents confirm t...

CVE-2023-53085

The CVE-2023-53085 issue affects the Linux kernel, specifically the drm/edid path. The root cause is a data leak: on EDID fetch errors that leave the transfer buffer unchanged, slab data can be leaked to logs. The fix clears the transfer buffer before fetching the EDID to prevent leaking informat...

CVE-2023-53094

Summary of CVE-2023-53094 (Linux kernel) : A race in the fsl_lpuart RX DMA shutdown can lead to a NULL pointer dereference when a DMA completion occurs during shutdown. The issue arises in the path: lpuart32_shutdown -> lpuart_dma_shutdown -> del_timer_sync -> lpuart_dma_rx_complete -&gt...

CVE-2024-26711

CVE-2024-26711 is a Linux kernel issue in the IIO subsystem: iio: adc: ad4130, where clk_init_data was not fully initialized, potentially affecting exposure of the internal clock on the CLK pin. The root cause is partial initialization of the clk_init_data structure. The documented fix is to zero...

CVE-2024-26871

CVE-2024-26871 is a Linux kernel vulnerability affecting F2FS where a NULL pointer dereference can occur in f2fs_submit_page_write() due to io->bio being NULL in a race condition. The fix relocates zone-end calculation to run for each fio before skip handling, preventing dereference when multi...

CVE-2024-35851

CVE-2024-35851 affects Linux kernel Bluetooth (qca): NULL pointer dereference when waking up non-serdev Qualcomm ROME controllers during suspend due to a missing sanity check on the HCI UART serdev pointer. The fix adds a NULL-pointer check to prevent wakeup() from dereferencing a NULL in suspend...

CVE-2024-38594

CVE-2024-38594 concerns the Linux kernel net: stmmac subsystem where the EST lock was moved from the EST structure into struct stmmac_priv to avoid reinitializing the mutex when reinitializing the EST. The underlying issue was that reinitializing the EST could reset the embedded mutex lock, trigg...

CVE-2024-38606

CVE-2024-38606 in the Linux kernel relates to the crypto/qat path where adf_send_admin_tl_start() loads a slice_cnt array from FW and tl_print_dev_data() reports statistics via debugfs. If the FW returns an unexpected slice count, the code could read beyond the allocated buffer, potentially trigg...

CVE-2024-38663

CVE-2024-38663 (Linux kernel) affects the blk-cgroup iostat/stat reset path. After commit 3b8cc6298724, each iostat instance is added to the blkcg per-CPU list, so blkcg_reset_stats() can’t reset the stat instance by memset(), risking list corruption. The fix is to reset only the counter portion,...

CVE-2024-40963

CVE-2024-40963 (Linux kernel, MIPS BMIPS BCM6358) : Affects devices where BMIPS CBR address can be 0, triggering kernel panic when arch_sync_dma_for_cpu_all is called. The root cause described is BMIPS_GET_CBR() returning 0 instead of a valid address and a non-failing read of read_c0_brcm_cmt_loc...

CVE-2024-41051

CVE-2024-41051 affects the Linux kernel cachefiles subsystem. When queuing ondemand_object_worker() to reopen an object, cachefiles_object may be freed if the related erofs is unmounted, causing a use-after-free if ondemand_object_worker() runs after object free. The fix requires canceling or wai...

CVE-2024-42115

CVE-2024-42115 involves the Linux kernel jffs2 subsystem. The issue stems from a memory-detection pattern in jffs_inode_info where fields (except sem) could remain uninitialized, causing a NULL/dangling target being freed in jffs2_free_inode during iget_locked/destroy_inode races under high press...

CVE-2024-42296

CVE-2024-42296 refers to a Linux kernel issue in f2fs where f2fs_convert_inline_inode() could return 0 on readonly devices, triggering a panic during writeback of an inline inode’s dirty page. The fix changes the return to EROFS in readonly scenarios. The vulnerability is documented with affected...

CVE-2024-42317

The CVE-2024-42317 issue affects the Linux kernel mm/huge_memory path on ARM64 with 64KB base pages. It stems from xarray not supporting arbitrary page cache sizes beyond MAX_PAGECACHE_ORDER, which can allow a 512 MB page cache in the collapsing path and triggers a warning when splitting an xarra...