CVE-2017-5972

CVE-2017-5972 affects the Linux kernel 3.x TCP stack. The issue is that SYN cookies protection is not correctly applied for fast-network connection scenarios, enabling remote attackers to cause CPU denial of service by sending a flood of TCP SYN packets (as demonstrated against kernel-3.10.0 in C...

CVE-2023-53095

The CVE-2023-53095 issue is in the Linux kernel DRM TTM path, where a NULL pointer dereference could occur during swap decisions. The root cause is a mismatch in locking between res->bo (LRU lock) and bo->resource (object lock), with bo->resource clearing also guarded by the LRU lock. Th...

CVE-2026-53360

The CVE-2026-53360 entry concerns a Linux kernel KVM/SEV issue: if GHCB v2+ is used, in-GHCB scratch area must reside in the shared buffer. The root cause is a bounds check flaw in snp_begin_psc() where idx_end is validated against VMGEXIT_PSC_MAX_COUNT (253) but not against the actual buffer siz...

CVE-2006-2935

CVE-2006-2935 affects the Linux kernel starting with 2.2.16 and later, where the dvd_read_bca function in the DVD handling code (drivers/cdrom/cdrom.c) assigns the wrong value to a length variable, enabling a local user to trigger a buffer overflow via a crafted USB Storage device and execute arb...

CVE-2008-1375

CVE-2008-1375 describes a race condition in the Linux kernel’s directory notification subsystem (dnotify). It affects Linux kernel 2.6.x before 2.6.24.6, and 2.6.25 before 2.6.25.1. Successful exploitation could allow local users to cause a denial of service (OOPS) and possibly gain privileges vi...

CVE-2009-0269

CVE-2009-0269 refers to a local kernel vulnerability in the Linux kernel’s eCryptfs inode handling. The flaw, described as a readlink error path in fs/ecryptfs/inode.c, can lead to denial of service (fault or memory corruption) and possibly other unspecified effects by causing the code to use a -...

CVE-2009-3620

CVE-2009-3620 affects the ATI Rage 128 (r128) driver in the Linux kernel, where the driver fails to properly verify Concurrent Command Engine (CCE) state initialization. This local vulnerability can cause a NULL pointer dereference and system crash (DoS) and may allow privilege escalation via uns...

CVE-2009-3889

CVE-2009-3889 affects the Linux kernel megaraid_sas driver; the dbg_lvl file is world-writable in kernels before 2.6.27, enabling local users to modify driver behavior and logging level. MiracleLinux AXSA:2010-141 references this issue among others and indicates a fix in kernel 2.6.27+ as part of...

CVE-2010-0622

CVE-2010-0622 affects the Linux kernel’s wake_futex_pi path in kernel/futex.c. The advisory notes that kernels before 2.6.33-rc7 fail to handle certain unlock operations for Priority Inheritance futexes, allowing local users to trigger a denial of service (OOPS) and potentially other impacts via ...

CVE-2011-3209

CVE-2011-3209 affects the Linux kernel on x86 prior to 2.6.26. The div_long_long_rem implementation in include/asm-x86/div64.h can trigger a Divide Error Fault and system panic when clock_gettime is invoked by local users, leading to a denial of service. The impact is local, with a complete avail...

CVE-2011-3359

CVE-2011-3359 affects the Linux kernel (pre-2.6.39), specifically the b43 wireless driver. The dma_rx path does not allocate receive buffers properly, enabling remote attackers to crash the system via a crafted frame (DoS). Affected code is in drivers/net/wireless/b43/dma.c. Remediation: upgrade ...

CVE-2012-3430

CVE-2012-3430 : In the Linux kernel before 3.0.44, the function rds_recvmsg in net/rds/recv.c fails to initialize a structure member, allowing a local attacker to read potentially sensitive kernel stack memory via recvfrom or recvmsg on an RDS socket. Impact: information disclosure. Affected: Lin...

CVE-2012-4508

CVE-2012-4508 is a race condition in the Linux kernel's ext4 extents handling (fs/ext4/extents.c) that, before version 3.4.16, allows a local unprivileged user to read data from a deleted file by reading an extent that isn’t properly marked uninitialized. The issue is fixed in the 3.4.16 update (...

CVE-2013-0268

The CVE-2013-0268 issue affects the Linux kernel, specifically the msr_open function in arch/x86/kernel/msr.c, vulnerable before version 3.7.6. The vulnerability allows local unprivileged users to bypass capability restrictions and gain root by running a crafted application (msr32.c). Affected co...

CVE-2013-0913

CVE-2013-0913 affects the i915 DRM driver in the Linux kernel up to version 3.8.3. The vulnerability is an integer overflow in drivers/gpu/drm/i915/i915_gem_execbuffer.c, which can be triggered by a crafted relocation-copy sequence and may lead to a heap-based buffer overflow, potentially enablin...

CVE-2013-1773

CVE-2013-1773 involves a buffer overflow in the Linux kernel VFAT UTF-8 to UTF-16 conversion during a VFAT write when utf8 mount option is used. Affects Linux kernel before 3.3; local privilege escalation or system crash possible. The connected advisory set includes references to kernel patches (...

CVE-2013-7264

The CVE-2013-7264 issue affects the Linux kernel up to version 3.12.3, specifically the l2tp_ip_recvmsg function in net/l2tp/l2tp_ip.c. The vulnerability arises because a length value is updated before ensuring that the associated data structure is initialized, enabling a local attacker to leak k...

CVE-2014-4611

CVE-2014-4611 concerns an integer overflow in the LZ4 implementation used in Yann Collet LZ4 prior to r118 and in the Linux kernel’s lz4_decompress.c (linux kernel before 3.15.2) on 32-bit platforms. A crafted Literal Run can trigger improper handling, enabling context-dependent attackers to caus...

CVE-2014-7825

CVE-2014-7825 affects the Linux kernel up to 3.17.2, specifically the file kernel/trace/trace_syscalls.c. The vulnerability arises from improper handling of private syscall numbers when using the perf subsystem, enabling a local attacker to trigger an out-of-bounds read and OOPS, and potentially ...

CVE-2015-4004

The CVE-2015-4004 issue affects the OZWPAN driver in the Linux kernel up to version 4.0.5. The flaw stems from parsing crafted packets using an untrusted length field, allowing remote attackers to read kernel memory (information disclosure) or trigger a denial of service (out-of-bounds read and s...

CVE-2015-4036

CVE-2015-4036: An array index error in Linux kernel before 4.0 in drivers/vhost/scsi.c (tcm_vhost_make_tpg, renamed to vhost_scsi_make_tpg) can allow local guest OS users to cause a denial of service (memory corruption) or potentially other impact via a crafted VHOST_SCSI_SET_ENDPOINT IOCTL. Expl...

CVE-2016-2549

CVE-2016-2549 affects the Linux kernel prior to version 4.4.1, where sound/core/hrtimer.c fails to prevent recursive callback access, enabling local users to trigger a denial of service (deadlock) via a crafted ioctl. Connected advisories (Unity Linux UTSA-2026-000840/000...) confirm this issue i...

CVE-2017-18379

CVE-2017-18379 is an issue in the Linux kernel prior to 4.14, where an out-of-bounds access occurs in the nvme target driver, specifically in drivers/nvme/target/fc.c. The connected Nessus advisories (Unity Linux UTSA-2026-001233/002545/002935) reference the same vulnerability and reiterate that ...

CVE-2018-13098

CVE-2018-13098 applies to the Linux kernel’s F2FS implementation, specifically fs/f2fs/inode.c up to version 4.17.3. The issue is a denial-of-service condition caused by a slab out-of-bounds read and a BUG when FI_EXTRA_ATTR is set in an inode of a modified F2FS image. Connected Nessus advisories...

CVE-2019-0145

CVE-2019-0145 : Buffer overflow in the i40e driver for Intel(R) Ethernet 700 Series Controllers, affecting versions before 7.0. An authenticated local user can potentially escalate privileges. The vulnerability arises in the i40e driver implementation and is documented in multiple advisories refe...

CVE-2020-36786

The CVE-2020-36786 entry concerns a memory leak in the Linux kernel’s media: atomisp driver (staging) where, if lm3554_platform_data_func returns an error, flash object memory is leaked on the error return path. The fix introduces an error return path that frees flash and renames labels (fail2→fa...

CVE-2021-47179

CVE-2021-47179 affects the Linux kernel NFSv4 pnfs path. The root cause is in _pnfs_return_layout() calling pnfs_mark_matching_lsegs_return() with a NULL struct_pnfs_layout_range, which is then dereferenced, causing an oops/crash. The issue was fixed by commit de144ff4234f, which alters _pnfs_ret...

CVE-2021-47194

CVE-2021-47194 : Linux kernel vulnerability in cfg80211 where switching from P2P_GO to ADHOC via NL80211_CMD_SET_INTERFACE failed to call cfg80211_stop_ap, allowing in-use data to be re-initialized (e.g., sdata->assigned_chanctx_list) while still in assigned_vifs, corrupting the linked list. D...

CVE-2021-47201

Summary (CVE-2021-47201) : In the Linux kernel, the iavf driver vulnerability is resolved by swapping the call order in iavf_disable_vf() so that iavf_free_queues() occurs after iavf_free_q_vectors(). The bug caused a panic when the interface was disabled and then re-enabled after PF communicatio...

CVE-2021-47465

CVE-2021-47465 is a Linux kernel vulnerability affecting the PPC Book3S HV emergency stack handling. The issue occurred in idle_kvm_start_guest(), where the previous approach stored CR/LR and stack frames on the emergency stack without ensuring a valid frame boundary, causing writes outside the e...

CVE-2021-47589

In CVE-2021-47589, the Linux kernel igbvf driver contains a double-free / use-after-free path in igbvf_probe. If register_netdev() fails, control flows to err_hw_init then err_ioremap, and free_netdev attempts to clean dev->napi_list entries while adapter->rx_ring (which holds napi) has alr...

CVE-2021-47623

CVE-2021-47623 affects the PowerPC path in the Linux kernel where unmapping a fixmap entry via __set_fixmap() (FIXMAP_PAGE_CLEAR) ends up calling map_kernel_page(), which fails if invoked a second time for the same page. The connected documents confirm the root cause in arch/powerpc/mm/pgtable.c ...

CVE-2022-4127

CVE-2022-4127 : A NULL pointer dereference in the Linux kernel function io_files_update_with_index_alloc can allow a local user to crash the system, causing a denial of service. The vulnerability affects the kernel and is documented across multiple sources (NVD/OSV/CNVD, Nessus/NASL entries). Som...

CVE-2022-48841

Vulnerability CVE-2022-48841 affects the Linux kernel ice driver: NULL pointer dereference in ice_update_vsi_tx_ring_stats() during Tx ring stats update. If the ring pointer is NULL, a later access to propagate Tx stats to VSI stats could crash. The fix changes logic to move to the next ring when...

CVE-2022-49203

CVE-2022-49203 – Linux kernel (drm/amd/display): The issue is a double free during GPU reset on DC streams. Root cause: during reset, a pre-commit state backup retains valid link encoder assignments; DC clears them in the current state but not in the backup, freeing an extra reference and causing...

CVE-2022-49234

CVE-2022-49234 is a Linux kernel vulnerability in the VLAN filtering path for DSA cross-chip setups. The issue: when a switch (sw1) p4 leaves a bridge, dsa_port_vlan_filtering would also be invoked for sw2p1 and sw3p1, potentially referencing a non-existent port and causing array out-of-bounds ac...

CVE-2022-49281

CVE-2022-49281 affects Linux kernel CIFS multiuser handling: each user has a separate tcon and handle for a cached directory, but on unmount the kernel must release the pinned dentry for every tcon rather than only the master tcon. If not, unmount can emit warnings of in-use dentries. The issue i...

CVE-2022-49307

CVE-2022-49307 : In the Linux kernel, the tty synclink_gt driver can trigger a null-pointer dereference in slgt_clean() when alloc_hdlcdev() fails and the module is removed. Affected component: the synclink_gt (tty) HDLC driver path in the kernel. The root cause is a null dereference of info->...

CVE-2022-49308

The CVE-2022-49308 entry describes a Linux kernel extcon overflow/NULL dereference vulnerability that could cause an Oops when sysfs state_show() runs before driver data is set. The root cause is extcon device creation occurring before drvdata is initialized, leading to an edev NULL dereference d...

CVE-2022-49373

CVE-2022-49373 affects the Linux kernel watchdog ts4800_wdt refcount handling. According to connected docs, the issue arises because of_parse_phandle() returns a node pointer with its refcount incremented and missing of_node_put() on error paths, leading to a refcount leak in ts4800_wdt_probe. Th...

CVE-2022-49712

CVE-2022-49712 : In the Linux kernel, the usb: gadget: lpc32xx_udc probe had a refcount leak due to an extra reference from of_parse_phandle(); the fix adds of_node_put() to release the node when not needed. This mitigates a refcount leak in the probe path. Connected advisories (SUSE/Nessus/OpenV...

CVE-2022-49842

CVE-2022-49842: In the Linux kernel’s ASoC core, a use-after-free in snd_soc_exit() was fixed. The root cause was a missing error check in snd_soc_init() where snd_soc_util_init() could fail and return value was ignored, causing soc_dummy_dev to be unregistered twice. The fix requires handling er...

CVE-2023-0030

CVE-2023-0030 describes a use-after-free in the Linux kernel nouveau driver related to triggering a memory overflow that causes nvkm_vma_tail to fail. Affected component: nouveau driver in the Linux kernel; root cause is use-after-free leading to crash and potential local privilege escalation. Pr...

CVE-2023-35826

CVE-2023-35826 affects the Linux kernel before 6.3.2, with a use-after-free in cedrus_remove (drivers/staging/media/sunxi/cedrus/cedrus.c). The issue is described in the NVD entry and corroborated by related advisories; the root cause is a resource management/use-after-free in the cedrus driver. ...

CVE-2023-52499

The CVE-2023-52499 entry documents a Linux kernel issue on powerpc/47x where a flaw in ret_from_syscall causes 47x syscall return crashes during boot. The root cause, as described, is a faulty branch back after an icache flush, due to commit 6f76a01173cc that removed the 1 label and caused mis-br...

CVE-2023-52590

CVE-2023-52590 affects the Linux kernel OCFS2 rename path: when renaming a directory, the code previously touched the renamed directory even if the parent did not change, risking filesystem corruption due to missing appropriate locking. The vulnerability is resolved by upstream kernel fixes that ...

CVE-2023-53101

CVE-2023-53101 affects the Linux kernel ext4 bootloader inode handling. The issue arises when EXT4_IOC_SWAP_BOOT initializes an inode with a non-zero i_size, causing i_disksize to remain non-zero and creating an i_size vs i_disksize inconsistency that can trigger a kernel warning (as shown in the...

CVE-2023-53110

In CVE-2023-53110, the Linux kernel vulnerability affects the SMC subsystem (net/smc). The issue arises from a race between smc_smcr_terminate_all() and smc_buf_create(), which can lead to a NULL sndbuf_desc being dereferenced in smc_cdc_tx_handler during CQE processing, causing a kernel panic (a...

CVE-2024-36951

Mode C: CVE-2024-36951 affects the Linux kernel via the DRM/AMDKFD path. The root cause is a CP interrupt bug that can raise bad packet garbage exception codes; the fix performs a range check to ensure the debugger and runtime do not receive garbage codes. The update also guards exception code ty...

CVE-2024-38628

The CVE-2024-38628 issue is in the Linux kernel USB gadget u_audio subsystem. It describes a race condition where controls are used after free during gadget unbind. The root cause is use-after-free-like racing in the gadget unbind path, leading to potential corruption or instability. The publishe...