CVE-2009-1337

CVE-2009-1337 : Affected: Linux kernel up to 2.6.30-rc1 (exit_notify in kernel/exit.c). Root cause: exit_notify does not restrict exit signals when CAP_KILL is held, enabling a local user to set a process exit_signal and use exec to launch a setuid program. Impact: local privilege escalation via ...

CVE-2024-46846

The CVE-2024-46846 issue is a Linux kernel vulnerability found in the Rockchip SPI driver (spi: rockchip) involving unbalanced runtime PM/system PM handling. The root cause was a commit that stopped respecting runtime PM and unconditionally disabled clocks during system sleep, potentially double-...

CVE-2025-38475

CVE-2025-38475 concerns the Linux kernel SMC socket type confusion where smc_sock hijacks AF_INET/AF_INET6 internals, causing inet_opt to be interpreted as a function pointer due to inet_sock not being the first member of smc_sock. The root cause is the misalignment between smc_sock and inet_sock...

CVE-2025-38488

The CVE-2025-38488 issue affects the Linux kernel SMB client (smb: client) where use-after-free occurs in crypt_message() when hardware crypto accelerators perform asynchronous AEAD operations. The root cause was the removal of asynchronous crypto handling (assuming synchronous crypto), causing c...

CVE-2026-53360

The CVE-2026-53360 entry concerns a Linux kernel KVM/SEV issue: if GHCB v2+ is used, in-GHCB scratch area must reside in the shared buffer. The root cause is a bounds check flaw in snp_begin_psc() where idx_end is validated against VMGEXIT_PSC_MAX_COUNT (253) but not against the actual buffer siz...

CVE-2007-4573

CVE-2007-4573 - Linux kernel IA32 system call emulation on x86_64 : A flaw in IA32 emulation on 64-bit Linux kernels (2.4.x and 2.6.x up to 2.6.22.7) can allow a local unprivileged user to gain privileges by triggering an out-of-bounds access to the system call table via the %RAX register after t...

CVE-2009-2847

CVE-2009-2847 affects the Linux kernel: do_sigaltstack in kernel/signal.c on 64-bit systems fails to clear certain padding bytes, enabling local users to read sensitive data from the kernel stack via sigaltstack. Affected: Linux kernel versions 2.4–2.4.37 and 2.6 up to 2.6.31-rc5. Impact: local i...

CVE-2009-2908

CVE-2009-2908 affects the Linux kernel 2.6.31: the d_delete function in fs/ecryptfs/inode.c can lead to a negative dentry and a NULL pointer dereference. Local users can cause a kernel OOPS and potentially execute arbitrary code; exploitation demonstrated via a Mutt temporary directory in an eCry...

CVE-2011-1770

CVE-2011-1770 affects the Linux kernel up to version 2.6.33.14, where an integer underflow in dccp_parse_options (net/dccp/options.c) can be triggered by a DCCP packet with an invalid feature options length, causing a buffer over-read and remote denial of service. The vulnerability is exploitable...

CVE-2013-0228

CVE-2013-0228 affects the Linux kernel before 3.7.9 on 32-bit Xen paravirt_ops platforms, where xen_iret in arch/x86/xen/xen-asm_32.S mishandles an invalid DS segment value. This allows guest OS users to gain guest OS privileges via a crafted application. Remediation is a kernel update to include...

CVE-2014-8086

CVE-2014-8086 : A race condition in the Linux kernel’s ext4_file_write_iter (fs/ext4/file.c) up to version 3.17 can enable a local attacker to cause a denial of service (file unavailability) by racing a write action with an F_SETFL O_DIRECT flag operation. Affected software is the Linux kernel be...

CVE-2017-5972

CVE-2017-5972 affects the Linux kernel 3.x TCP stack. The issue is that SYN cookies protection is not correctly applied for fast-network connection scenarios, enabling remote attackers to cause CPU denial of service by sending a flood of TCP SYN packets (as demonstrated against kernel-3.10.0 in C...

CVE-2021-46980

The CVE-2021-46980 item concerns Linux kernel USB Type-C UCSI: the code previously retrieved only the first 4 power data objects (PDOs) due to a 16-byte MESSAGE_IN limit. This could cause an out-of-bounds access in ucsi_psy_get_voltage_now() when a PD source advertises more than 4 PDOs (up to 7 a...

CVE-2021-46986

CVE-2021-46986: Linux kernel dwc3 gadget code flaw where freeing the gadget structure before endpoints are freed caused use-after-free/dangling-pointer issues. The description explains that dwc3_gadget_release() frees dwc->gadget upon device removal, but endpoints created by dwc3_gadget_init_e...

CVE-2021-47112

CVE-2021-47112 affects the Linux kernel x86/KVM subsystem. The issue is that PV (paravirtualization) features (Async PF, PV EOI, steal time) share memory with the hypervisor and are not properly torn down when resuming from hibernation, risking hypervisor access to stale memory locations after sw...

CVE-2021-47201

Summary (CVE-2021-47201) : In the Linux kernel, the iavf driver vulnerability is resolved by swapping the call order in iavf_disable_vf() so that iavf_free_queues() occurs after iavf_free_q_vectors(). The bug caused a panic when the interface was disabled and then re-enabled after PF communicatio...

CVE-2021-47473

CVE-2021-47473 affects the Linux kernel SCSI qla2xxx path. The issue is a memory leak in the error path of qla2x00_process_els() caused by an incorrect comparison of bsg_job->request->msgcode, which could leak fcport structures or free unallocated memory. The patch fixes the logic by ensuri...

CVE-2021-47589

In CVE-2021-47589, the Linux kernel igbvf driver contains a double-free / use-after-free path in igbvf_probe. If register_netdev() fails, control flows to err_hw_init then err_ioremap, and free_netdev attempts to clean dev->napi_list entries while adapter->rx_ring (which holds napi) has alr...

CVE-2021-47599

CVE-2021-47599 covers a Linux kernel bug in btrfs: during pruning/moving devices, btrfs_show_devname() could fail to find devices and emit a warning. The fix updates the device list handling so latest_dev->name is shown reliably in /proc/self/mounts, with devices kept alive under RCU protectio...

CVE-2022-20105

CVE-2022-20105 concerns MediaTek MM service vulnerable to a stack-based buffer overflow causing an out-of-bounds write, enabling local privilege escalation with SYSTEM-level execution privileges required by the exploit. All sources consistently describe the flaw as a local, no-user-interaction vu...

CVE-2022-3077

CVE-2022-3077 : A buffer overflow vulnerability in the Linux kernel Intel iSMT SMBus host controller driver, exposed via I2C_SMBUS (I2C_SMBUS_BLOCK_PROC_CALL) with malicious input. Local users can crash the system. Documents consistently reference this CVE in multiple advisories/plugins (e.g., Mi...

CVE-2022-48960

The CVE-2022-48960 issue is a Linux kernel use-after-free in net: hisilicon/hix5hd2_rx(), where a skb may be freed by napi_gro_receive() and later dereferenced. The connected sources confirm a fix was applied in the kernel (via stable tree commits referenced in the CVE entry). The vulnerability a...

CVE-2022-49076

CVE-2022-49076 concerns the Linux kernel RDMA/hfi1 subsystem. The issue is a use-after-free in the mm struct lifecycle: under certain conditions (e.g., MPI_Abort), hfi1_mmu_rb_unregister() may drop the last reference to a task mm, freeing it before its final use in hfi1_release_user_pages. This c...

CVE-2022-49176

CVE-2022-49176: Linux kernel fix for a use-after-free in bfq_dispatch_request (bfq) causing potential memory corruption in SCSI-mq paths. The issue is addressed by kernel patches referenced in the linked advisories (Unity Linux UTSA updates and Astra/Linux advisories). Exploitation status is not ...

CVE-2022-49532

CVE-2022-49532 affects the Linux kernel DRM virtio driver (virtio_gpu_conn_get_modes) where drm_cvt_mode may return NULL, leading to a NULL pointer dereference. The issue is demonstrated by a KASAN report showing a null deref while reading a 4-byte value from a NULL pointer. The connected advisor...

CVE-2022-49607

CVE-2022-49607 concerns a data race in the Linux kernel between perf_event_set_output() and perf_mmap_close() in the perf/core subsystem. The root cause is a race where perf_mmap_close() holds e2->mmap_mutex while perf_event_set_output() holds e1->mmap_mutex, allowing no serialization and p...

CVE-2022-49657

Mode C: CVE-2022-49657 affects the Linux kernel USB networking driver (usbnet). The issue is a memory leak in error paths, specifically usbnet_write_cmd_async() where the buffer(s) to be freed were mixed up, and later a fix for an uninitialized buffer pointer was added. Public references in Nessu...

CVE-2022-49658

CVE-2022-49658 concerns the Linux kernel’s BPF bounds propagation. The issue stems from insufficient propagation of tnum min/max bounds into register bounds during operations like adjust_scalar_min_max_vals, allowing a register that becomes a constant-like value to leak pointers when it is later ...

CVE-2022-49855

CVE-2022-49855 affects the Linux kernel wwan driver (net: wwan: iosm). The root cause is that ipc_pcie_read_bios_cfg() uses acpi_evaluate_dsm() to obtain BIOS power-state config but fails to free the returned acpi_object, causing a memory leak. The issue has been resolved by freeing the acpi_obje...

CVE-2022-49938

CVE-2022-49938 is a Linux kernel vulnerability in the CIFS SMB2_negotiation path. The issue is a small mempool leak in SMB2_negotiate() where, on certain dialect-mismatch failures, the code could exit without freeing the response buffer from mempool due to an incorrect -EIO handling. The fix tigh...

CVE-2022-49966

The CVE-2022-49966 issue is in the Linux kernel DRM AMD PM subsystem, where the fini_microcode interface for the Sienna Cichlid platform was missing. The root cause is the missing ->fini_microcode hook, which could contribute to memory leaks. The vulnerability is described as locally exploitab...

CVE-2023-52852

CVE-2023-52852 concerns a Linux kernel vulnerability in f2fs compression code where a use-after-free can occur for the dic pointer during readahead/multi-page decompress flow. The root cause, as described in the connected docs, is that after f2fs_decompress_cluster() is invoked and a cached page ...

CVE-2023-53086

The CVE-2023-53086 entry describes a Linux kernel fix for the wifi mt76 connac driver: WED status checks were erroneously performed on non-MMIO devices (e.g., USB/SDIO). The underlying issue could trigger a crash or kernel fault during authentication/association with wireless peers, as evidenced ...

CVE-2023-53142

CVE-2023-53142 concerns the Linux kernel ice driver where ice_get_module_eeprom() reads EEPROM in 8-byte blocks, but the last block isn’t safeguarded, allowing a potential buffer issue. The root cause traces to the refactor in commit e9c9692c8a81 (ice: Reimplement module reads used by ethtool), a...

CVE-2024-26632

CVE-2024-26632 affects the Linux kernel’s block layer, where iterating over an empty bio could trigger a NULL dereference in bio_first_folio() if bio contains no data. The fix moves the end-of-bio test from bio_next_folio() to bio_first_folio(), preventing oopses by avoiding dereferencing a NULL ...

CVE-2024-26711

CVE-2024-26711 is a Linux kernel issue in the IIO subsystem: iio: adc: ad4130, where clk_init_data was not fully initialized, potentially affecting exposure of the internal clock on the CLK pin. The root cause is partial initialization of the clk_init_data structure. The documented fix is to zero...

CVE-2024-26902

CVE-2024-26902 concerns the Linux kernel: a RISCV perf PMU overflow panic when setting bits for overflowed_ctrs due to using (1 <

CVE-2024-26909

CVE-2024-26909 affects the Linux kernel’s soc/qcom/pmic_glink_altmode code and its DRM bridge handling. The issue is a use-after-free that can occur during probe deferral when the dp-hpd bridge is registered before all resources are acquired, creating a race where a previously registered bridge p...

CVE-2024-36024

Summary: CVE-2024-36024 affects the drm/amd/display path in the Linux kernel. It describes a race condition during the DMCUB handshake that can cause a hardware hang by touching INBOX1 RPTR. The documented mitigation is to disable idle reallow as part of command/gpint execution to create a necess...

CVE-2024-36906

CVE-2024-36906: In the Linux kernel for ARM64, KASAN stack-poison was not cleared on exit via cpuidle, causing out-of-bounds reports when returning to the idle path. Root cause: instrumented functions leave stack shadow poisoned as CPUs unwind through idle, and prior context restoration can forge...

CVE-2024-39489

CVE-2024-39489 affects the Linux kernel's ipv6 sr seg6_hmac_init_algo. The issue was a memory leak where seg6_hmac_init_algo would return without cleaning up previously allocated memory if an allocation failed, leaking memory and crypto tfms. The fix adds proper cleanup by updating seg6_hmac_exit...

CVE-2024-40899

CVE-2024-40899 is a Linux kernel vulnerability in the cachefiles subsystem, causing a slab-use-after-free in cachefiles_ondemand_get_fd via a restore-triggered path that can lead to use-after-free in cachefiles_ondemand_daemon_read. The connected documents identify the issue as resolved by a patc...

CVE-2024-40970

The CVE-2024-40970 issue affects the Linux kernel’s dw-axi-dmac component. It describes a hw_desc array overrun when many descriptors are chained (e.g., nr_buffers=3 with 3 segments per descriptor, leading to 9 hw_descs). Root cause is improper handling in axi_desc_put() relative to allocated hw_...

CVE-2024-42234

CVE-2024-42234 refers to a Linux kernel vulnerability resolved by a fix for crashes during deferred split folio migration. The root cause involves deferred_split_scan() moving folios to a local list without proper protection, with folio->_deferred_list not being secured, potentially leading to...

CVE-2024-43825

The CVE-2024-43825 entry concerns a Linux kernel IIO subsystem issue: in iio_gts_build_avail_time_table, the sorting logic can misbehave when a time_us value is zero, potentially causing an out-of-bounds write (example sequence 3, 0, 1) and, if no zero times exist, elements may be copied unsorted...

CVE-2024-43857

CVE-2024-43857 — Linux kernel (f2fs): The patch fixes a potential NULL pointer dereference in is_end_zone_blkaddr() when checking the end of a zone, which could occur if f2fs is mounted as a single device. Affected component is the f2fs code path in the Linux kernel; root cause is a null referenc...

CVE-2024-43868

CVE-2024-43868 is a Linux kernel flaw in the riscv purgatory alignment path. When alignment handling is delegated to the kernel, purgatory must keep all addresses word-aligned because the kexec trap handler is used. If alignment isn’t enforced, hitting the exception could crash the system; in oth...

CVE-2024-46752

CVE-2024-46752 - Mode C (detailed, verified): The vulnerability is in the Linux kernel’s btrfs code path; specifically, update_ref_for_cow() previously used BUG_ON() and now returns an error, logs an error, and aborts the transaction when an extent buffer in the relocation tree lacks the full bac...

CVE-2024-46778

The CVE-2024-46778 entry describes a Linux kernel defect in drm/amd/display where UnboundedRequestEnabled was checked as a pointer (dml_bool_t *UnboundedRequestEnabled) instead of its boolean value, causing address-based checks rather than dereferenced value. This was fixed to address a reverse N...

CVE-2024-46796

CVE-2024-46796 affects the Linux kernel CIFS SMB2 path handling (smb2_set_path_size). The issue was a double put of @cfile when smb2_compound_op() returns -EINVAL, leading to use-after-free risks in the SMB/CIFS path, as the reference to @cfile could be dropped earlier. The fix ensures cifs_get_w...