CVE-2024-40899

CVE-2024-40899 is a Linux kernel vulnerability in the cachefiles subsystem, causing a slab-use-after-free in cachefiles_ondemand_get_fd via a restore-triggered path that can lead to use-after-free in cachefiles_ondemand_daemon_read. The connected documents identify the issue as resolved by a patc...

CVE-2025-37808

CVE-2025-37808 concerns the Linux kernel crypto: null algorithm. The issue arises because the default null algorithm may be freed in softirq context via af_alg, allowing a race that is mitigated by using spin locks instead of mutexes to protect the default null algorithm. The vulnerability is des...

CVE-2025-37857

CVE-2025-37857 affects the Linux kernel scsi: st driver. It fixes an array overflow in st_setup() by changing the array size from a fixed value to follow the parms size.

CVE-2025-37936

CVE-2025-37936: Linux kernel issue in perf/x86/intel/KVM where MSR_IA32_PEBS_ENABLE loaded for a guest could be masked incorrectly when deriving PEBS_ENABLE, causing guest PEBS to be enabled unintentionally and potentially crash the guest with a flood of #PFs. The fix masks the guest MSR value us...

CVE-2025-37964

CVE-2025-37964 relates to the Linux kernel x86/mm TLB handling. The issue is a bug in should_flush_tlb() that can suppress TLB flushes in a narrow window between load_new_mm_cr3() and writing the new mm state into loaded_mm, risking missed TLB flushes during address space switch. The fix widens t...

CVE-2025-38226

CVE-2025-38226 targets the Linux kernel, specifically the media/v4l2-tpg path used by vivid. The issue is a KASAN-detected vmalloc-out-of-bounds access in tpg_fill_plane_pattern and tpg_fill_plane_buffer (v4l2-tpg-core.c:2608 and 2705), causing a write of size 1440 to a kernel address during vivi...

CVE-2025-38443

CVE-2025-38443 affects the Linux kernel (nbd subsystem). A use-after-free occurs in the nbd_genl_connect() error path when nbd_start_device() is called but cleanup continues to use nbd->config, leading to freeing of memory in recv_work. The issue is triggered during certain error paths after d...

CVE-2025-38475

CVE-2025-38475 concerns the Linux kernel SMC socket type confusion where smc_sock hijacks AF_INET/AF_INET6 internals, causing inet_opt to be interpreted as a function pointer due to inet_sock not being the first member of smc_sock. The root cause is the misalignment between smc_sock and inet_sock...

CVE-2025-38488

The CVE-2025-38488 issue affects the Linux kernel SMB client (smb: client) where use-after-free occurs in crypt_message() when hardware crypto accelerators perform asynchronous AEAD operations. The root cause was the removal of asynchronous crypto handling (assuming synchronous crypto), causing c...

CVE-2026-53360

The CVE-2026-53360 entry concerns a Linux kernel KVM/SEV issue: if GHCB v2+ is used, in-GHCB scratch area must reside in the shared buffer. The root cause is a bounds check flaw in snp_begin_psc() where idx_end is validated against VMGEXIT_PSC_MAX_COUNT (253) but not against the actual buffer siz...

CVE-2007-4573

CVE-2007-4573 - Linux kernel IA32 system call emulation on x86_64 : A flaw in IA32 emulation on 64-bit Linux kernels (2.4.x and 2.6.x up to 2.6.22.7) can allow a local unprivileged user to gain privileges by triggering an out-of-bounds access to the system call table via the %RAX register after t...

CVE-2009-2847

CVE-2009-2847 affects the Linux kernel: do_sigaltstack in kernel/signal.c on 64-bit systems fails to clear certain padding bytes, enabling local users to read sensitive data from the kernel stack via sigaltstack. Affected: Linux kernel versions 2.4–2.4.37 and 2.6 up to 2.6.31-rc5. Impact: local i...

CVE-2009-2903

The CVE-2009-2903 entry concerns a memory leak in the Linux kernel appletalk subsystem. When the appletalk and ipddp modules are loaded but the ipddp device is not found, remote attackers can trigger memory consumption leading to a denial of service. The issue affects 2.4.x up to 2.4.37.6 and 2.6...

CVE-2009-2908

CVE-2009-2908 affects the Linux kernel 2.6.31: the d_delete function in fs/ecryptfs/inode.c can lead to a negative dentry and a NULL pointer dereference. Local users can cause a kernel OOPS and potentially execute arbitrary code; exploitation demonstrated via a Mutt temporary directory in an eCry...

CVE-2011-1770

CVE-2011-1770 affects the Linux kernel up to version 2.6.33.14, where an integer underflow in dccp_parse_options (net/dccp/options.c) can be triggered by a DCCP packet with an invalid feature options length, causing a buffer over-read and remote denial of service. The vulnerability is exploitable...

CVE-2013-0190

The CVE-2013-0190 entry concerns the xen_failsafe_callback function in the Xen hypervisor on Linux kernels (notably 2.6.23 and related versions). In 32-bit PVOPS guests, a local attacker can trigger an iret fault that leads to an incorrect stack pointer and stack corruption, enabling a denial of ...

CVE-2013-0228

CVE-2013-0228 affects the Linux kernel before 3.7.9 on 32-bit Xen paravirt_ops platforms, where xen_iret in arch/x86/xen/xen-asm_32.S mishandles an invalid DS segment value. This allows guest OS users to gain guest OS privileges via a crafted application. Remediation is a kernel update to include...

CVE-2014-7825

CVE-2014-7825 affects the Linux kernel up to 3.17.2, specifically the file kernel/trace/trace_syscalls.c. The vulnerability arises from improper handling of private syscall numbers when using the perf subsystem, enabling a local attacker to trigger an out-of-bounds read and OOPS, and potentially ...

CVE-2014-8086

CVE-2014-8086 : A race condition in the Linux kernel’s ext4_file_write_iter (fs/ext4/file.c) up to version 3.17 can enable a local attacker to cause a denial of service (file unavailability) by racing a write action with an F_SETFL O_DIRECT flag operation. Affected software is the Linux kernel be...

CVE-2021-46980

The CVE-2021-46980 item concerns Linux kernel USB Type-C UCSI: the code previously retrieved only the first 4 power data objects (PDOs) due to a 16-byte MESSAGE_IN limit. This could cause an out-of-bounds access in ucsi_psy_get_voltage_now() when a PD source advertises more than 4 PDOs (up to 7 a...

CVE-2021-46986

CVE-2021-46986: Linux kernel dwc3 gadget code flaw where freeing the gadget structure before endpoints are freed caused use-after-free/dangling-pointer issues. The description explains that dwc3_gadget_release() frees dwc->gadget upon device removal, but endpoints created by dwc3_gadget_init_e...

CVE-2021-47112

CVE-2021-47112 affects the Linux kernel x86/KVM subsystem. The issue is that PV (paravirtualization) features (Async PF, PV EOI, steal time) share memory with the hypervisor and are not properly torn down when resuming from hibernation, risking hypervisor access to stale memory locations after sw...

CVE-2021-47201

Summary (CVE-2021-47201) : In the Linux kernel, the iavf driver vulnerability is resolved by swapping the call order in iavf_disable_vf() so that iavf_free_queues() occurs after iavf_free_q_vectors(). The bug caused a panic when the interface was disabled and then re-enabled after PF communicatio...

CVE-2021-47473

CVE-2021-47473 affects the Linux kernel SCSI qla2xxx path. The issue is a memory leak in the error path of qla2x00_process_els() caused by an incorrect comparison of bsg_job->request->msgcode, which could leak fcport structures or free unallocated memory. The patch fixes the logic by ensuri...

CVE-2021-47589

In CVE-2021-47589, the Linux kernel igbvf driver contains a double-free / use-after-free path in igbvf_probe. If register_netdev() fails, control flows to err_hw_init then err_ioremap, and free_netdev attempts to clean dev->napi_list entries while adapter->rx_ring (which holds napi) has alr...

CVE-2021-47599

CVE-2021-47599 covers a Linux kernel bug in btrfs: during pruning/moving devices, btrfs_show_devname() could fail to find devices and emit a warning. The fix updates the device list handling so latest_dev->name is shown reliably in /proc/self/mounts, with devices kept alive under RCU protectio...

CVE-2022-20105

CVE-2022-20105 concerns MediaTek MM service vulnerable to a stack-based buffer overflow causing an out-of-bounds write, enabling local privilege escalation with SYSTEM-level execution privileges required by the exploit. All sources consistently describe the flaw as a local, no-user-interaction vu...

CVE-2022-3077

CVE-2022-3077 : A buffer overflow vulnerability in the Linux kernel Intel iSMT SMBus host controller driver, exposed via I2C_SMBUS (I2C_SMBUS_BLOCK_PROC_CALL) with malicious input. Local users can crash the system. Documents consistently reference this CVE in multiple advisories/plugins (e.g., Mi...

CVE-2022-48790

CVE-2022-48790 concerns a use-after-free in the Linux kernel nvme path during controller reset while loading, caused by a race between AER submission and ctrl readiness. The fixed patch adds a ctrl state check and ensures the controller state is RESETTING before further AER submissions, along wit...

CVE-2022-48960

The CVE-2022-48960 issue is a Linux kernel use-after-free in net: hisilicon/hix5hd2_rx(), where a skb may be freed by napi_gro_receive() and later dereferenced. The connected sources confirm a fix was applied in the kernel (via stable tree commits referenced in the CVE entry). The vulnerability a...

CVE-2022-49076

CVE-2022-49076 concerns the Linux kernel RDMA/hfi1 subsystem. The issue is a use-after-free in the mm struct lifecycle: under certain conditions (e.g., MPI_Abort), hfi1_mmu_rb_unregister() may drop the last reference to a task mm, freeing it before its final use in hfi1_release_user_pages. This c...

CVE-2022-49176

CVE-2022-49176: Linux kernel fix for a use-after-free in bfq_dispatch_request (bfq) causing potential memory corruption in SCSI-mq paths. The issue is addressed by kernel patches referenced in the linked advisories (Unity Linux UTSA updates and Astra/Linux advisories). Exploitation status is not ...

CVE-2022-49532

CVE-2022-49532 affects the Linux kernel DRM virtio driver (virtio_gpu_conn_get_modes) where drm_cvt_mode may return NULL, leading to a NULL pointer dereference. The issue is demonstrated by a KASAN report showing a null deref while reading a 4-byte value from a NULL pointer. The connected advisor...

CVE-2022-49607

CVE-2022-49607 concerns a data race in the Linux kernel between perf_event_set_output() and perf_mmap_close() in the perf/core subsystem. The root cause is a race where perf_mmap_close() holds e2->mmap_mutex while perf_event_set_output() holds e1->mmap_mutex, allowing no serialization and p...

CVE-2022-49657

Mode C: CVE-2022-49657 affects the Linux kernel USB networking driver (usbnet). The issue is a memory leak in error paths, specifically usbnet_write_cmd_async() where the buffer(s) to be freed were mixed up, and later a fix for an uninitialized buffer pointer was added. Public references in Nessu...

CVE-2022-49658

CVE-2022-49658 concerns the Linux kernel’s BPF bounds propagation. The issue stems from insufficient propagation of tnum min/max bounds into register bounds during operations like adjust_scalar_min_max_vals, allowing a register that becomes a constant-like value to leak pointers when it is later ...

CVE-2022-49855

CVE-2022-49855 affects the Linux kernel wwan driver (net: wwan: iosm). The root cause is that ipc_pcie_read_bios_cfg() uses acpi_evaluate_dsm() to obtain BIOS power-state config but fails to free the returned acpi_object, causing a memory leak. The issue has been resolved by freeing the acpi_obje...

CVE-2022-49938

CVE-2022-49938 is a Linux kernel vulnerability in the CIFS SMB2_negotiation path. The issue is a small mempool leak in SMB2_negotiate() where, on certain dialect-mismatch failures, the code could exit without freeing the response buffer from mempool due to an incorrect -EIO handling. The fix tigh...

CVE-2022-49966

The CVE-2022-49966 issue is in the Linux kernel DRM AMD PM subsystem, where the fini_microcode interface for the Sienna Cichlid platform was missing. The root cause is the missing ->fini_microcode hook, which could contribute to memory leaks. The vulnerability is described as locally exploitab...

CVE-2023-52852

CVE-2023-52852 concerns a Linux kernel vulnerability in f2fs compression code where a use-after-free can occur for the dic pointer during readahead/multi-page decompress flow. The root cause, as described in the connected docs, is that after f2fs_decompress_cluster() is invoked and a cached page ...

CVE-2023-53086

The CVE-2023-53086 entry describes a Linux kernel fix for the wifi mt76 connac driver: WED status checks were erroneously performed on non-MMIO devices (e.g., USB/SDIO). The underlying issue could trigger a crash or kernel fault during authentication/association with wireless peers, as evidenced ...

CVE-2023-53142

CVE-2023-53142 concerns the Linux kernel ice driver where ice_get_module_eeprom() reads EEPROM in 8-byte blocks, but the last block isn’t safeguarded, allowing a potential buffer issue. The root cause traces to the refactor in commit e9c9692c8a81 (ice: Reimplement module reads used by ethtool), a...

CVE-2024-26632

CVE-2024-26632 affects the Linux kernel’s block layer, where iterating over an empty bio could trigger a NULL dereference in bio_first_folio() if bio contains no data. The fix moves the end-of-bio test from bio_next_folio() to bio_first_folio(), preventing oopses by avoiding dereferencing a NULL ...

CVE-2024-26711

CVE-2024-26711 is a Linux kernel issue in the IIO subsystem: iio: adc: ad4130, where clk_init_data was not fully initialized, potentially affecting exposure of the internal clock on the CLK pin. The root cause is partial initialization of the clk_init_data structure. The documented fix is to zero...

CVE-2024-26902

CVE-2024-26902 concerns the Linux kernel: a RISCV perf PMU overflow panic when setting bits for overflowed_ctrs due to using (1 <

CVE-2024-26909

CVE-2024-26909 affects the Linux kernel’s soc/qcom/pmic_glink_altmode code and its DRM bridge handling. The issue is a use-after-free that can occur during probe deferral when the dp-hpd bridge is registered before all resources are acquired, creating a race where a previously registered bridge p...

CVE-2024-35909

CVE-2024-35909 affects the Linux kernel wwan/t7xx path where 64-bit register accesses could fault due to 32-bit alignment in some 64‑bit platforms. The fix splits 64-bit accesses into 32-bit pairs to ensure proper alignment, preventing OOPS/paging faults as shown in the crash trace. Remediation i...

CVE-2024-36024

Summary: CVE-2024-36024 affects the drm/amd/display path in the Linux kernel. It describes a race condition during the DMCUB handshake that can cause a hardware hang by touching INBOX1 RPTR. The documented mitigation is to disable idle reallow as part of command/gpint execution to create a necess...

CVE-2024-36906

CVE-2024-36906: In the Linux kernel for ARM64, KASAN stack-poison was not cleared on exit via cpuidle, causing out-of-bounds reports when returning to the idle path. Root cause: instrumented functions leave stack shadow poisoned as CPUs unwind through idle, and prior context restoration can forge...

CVE-2024-39489

CVE-2024-39489 affects the Linux kernel's ipv6 sr seg6_hmac_init_algo. The issue was a memory leak where seg6_hmac_init_algo would return without cleaning up previously allocated memory if an allocation failed, leaking memory and crypto tfms. The fix adds proper cleanup by updating seg6_hmac_exit...