CVE-2024-46796

CVE-2024-46796 (Linux kernel CIFS SMB2 client) : The vulnerability is due to a double put of @cfile in smb2_set_path_size() when smb2_compound_op() returns -EINVAL, causing a use-after-free in a Kasan trace during CIFS detach. The fix calls cifs_get_writable_path() before retrying, preventing the...

CVE-2024-49970

CVE-2024-49970 affects the Linux kernel DRM AMD display path. The issue is a bounds check failure in dcn401_stream_encoder_create for the DCN401 encoder: the stream_enc_regs array, sized for indices 0–3, could be accessed with eng_id = 5, causing a buffer overflow and undefined behavior. The vuln...

CVE-2025-37856

The CVE-2025-37856 entry pertains to the Linux kernel’s btrfs subsystem, where hardening of block_group::bg_list against list_del() races was applied. The vulnerability centered on potential race conditions between bg_list list_del_init() and operations like btrfs_mark_bg_unused() or btrfs_mark_b...

CVE-2025-37861

The CVE 2025-37861 pertains to the Linux kernel SCSI MPI3MR driver where the TM thread could process reply queues while the reset thread reinitializes them, causing an access to an invalid queue ID (0xFFFF) and a crash. The fix adds a synchronization flag io_admin_reset_sync. Before a reset, the ...

CVE-2025-37897

CVE-2025-37897 affects the Linux kernel wifi driver (plfxlc) where plfxlc_mac_release() asserts mac->lock, which is incorrect because mac->lock cannot be held when probe fails or the device is disconnected. The issue can trigger a kernel warning (warning trace shown in the advisory) and is ...

CVE-2025-37983

CVE-2025-37983 is a Linux kernel issue where an inode allocation path could leak a dentry due to an OOM related leak in qibfs. The description confirms the vulnerability was resolved by a fix merged in the kernel ("qibfs: fix another leak"). Public connected sources (Azure Linux, Astra Linux, and...

CVE-2024-46697

CVE-2024-46697 is a Linux kernel issue in nfsd where nfsd4_fattr_args.context could contain uninitialized data if control flow used a goto out before the security label check. The fix initializes context early to prevent freeing junk on the stack when nfsd4_encode_fattr4 takes that path. Connecte...

CVE-2024-46788

The CVE-2024-46788 vulnerability affects the Linux kernel in tracing/osnoise, where start_kthread() and stop_thread() were not consistently called with interface_lock held. This could allow a kthread_stop() on a thread that should not be stopped, triggering an OOPS in early timer handling (hrtime...

CVE-2024-46869

CVE-2024-46869 : Linux kernel Bluetooth driver btintel_pcie failed to allocate memory for its private data (btintel_data). Fix commits add memory allocation during driver init to store internal state, mitigating potential driver instability. Affected: Linux kernel Bluetooth stack (btintel_pcie). ...

CVE-2024-50119

CVE-2024-50119 (Linux kernel - CIFS) : The vulnerability arises in the CIFS subsystem where destroying cifs_io_request_pool triggers a warning due to incorrect mempool handling. The issue occurs because cifs_io_request_pool is not created by mempool_create(), suggesting the correct cleanup path i...

CVE-2024-50260

CVE-2024-50260 affects the Linux kernel sock_map subsystem. The issue is a NULL-pointer dereference between sock_map_link_detach and sock_map_link_update_prog under sockmap_mutex, potentially dereferencing sockmap_link->map when a link is being released during an update. The fix adds a NULL po...

CVE-2024-53211

CVE-2024-53211 : In the Linux kernel, the l2tp_exit_net path could observe a non-empty IDR due to a radix-tree internal-node condition when idr_is_empty() was used. The bug allowed idr_is_empty() to return false despite no items, triggering a warning and potentially unsafe destruction sequence. T...

CVE-2024-57952

CVE-2024-57952 affects the Linux kernel through a revert of the libfs offset-dir fix, restoring prior behavior that could hide directory entries when the offset allocator wraps. Public docs in the SUSE/OpenSUSE advisories note this as a fix delivered via kernel updates (openSUSE-SU-2025-20081-1) ...

CVE-2025-21794

The CVE-2025-21794 issue affects the Linux kernel HID driver for thrustmaster devices (HID: hid-thrustmaster). It is a stack-out-of-bounds read in the core usb_check_int_endpoints() path caused by passing an ep_addr array to a loop that advances past the end of the array when a null terminator is...

CVE-2025-21915

In the Linux kernel, a potential use-after-free (UAF) race was fixed in cdx: driver_override_show() within drivers/cdx/cdx.c. The show() function is part of a DEVICE_ATTR_RW that also uses driver_override_store() to update the value. Because show() and store() can run concurrently in sysfs, drive...

CVE-2025-21946

The CVE-2025-21946 entry affects the Linux kernel ksmbd component; the issue is a slab-out-of-bounds in parse_sec_desc() caused by offsets (osidoffset, gsidoffset, dacloffset) exceeding the smb_ntsd structure, and by not verifying the subauth array size when validating a SID. The connected Astra ...

CVE-2025-21984

Technical details for CVE-2025-21984 are not publicly disclosed in the provided Connected documents; no vendor/product/version specifics or fixes are given here. Monitor for updates.

CVE-2025-22077

CVE-2025-22077 concerns Linux kernel CIFS SMB client TCP timers deadlock after rmmod. The advisory notes the patch that attempted to fix a NULL dereference in LOCKDEP via a CIFS netns reference was reverted, reviving a kernel TCP socket timer lifecycle mismatch. This reversion can cause FIN_WAIT_...

CVE-2025-37973

CVE-2025-37973 affects the Linux kernel Wi-Fi stack, specifically the cfg80211 defragmentation logic for multi-link elements. The issue is a miscalculation during multi-link element defragmentation that adds the MLE length to the total IEs length, which can cause an out-of-bounds access if the ML...

CVE-2025-38002

CVE-2025-38002 concerns the Linux kernel io_uring/fdinfo path. The fix acquires the ctx->uring_lock around io_uring_show_fdinfo() and wraps the whole process in a ->uring_lock_trylock, returning no output if the lock can’t be grabbed. This addresses a race when the ring is actively resized,...

CVE-2025-38471

CVE-2025-38471 concerns the Linux kernel TLS path. The TLS queue can operate on an old skb after aggressive net-next skb compaction, leading to a slab-use-after-free in tls_strp_check_rcv. The Astra Linux bulletin confirms the fix is to always refresh the queue when reading a socket, instead of r...

CVE-2026-46275

CVE-2026-46275 affects the Linux kernel Bluetooth hci_uart subsystem, with Use-After-Free and race conditions in lifecycle teardown (init/close paths) that can trigger UAFs and NPDs when workqueues and protocol paths are torn down. The documented fix involves reordering ttys close handling (clear...

CVE-2007-3104

The vulnerability CVE-2007-3104 affects the Linux kernel 2.6 in use by RHEL 4.5 and similar distros, where sysfs_readdir can dereference a NULL inode in a dentry, causing a kernel OOPS (local access). This denial-of-service risk is described in multiple advisories, with confirmed references to th...

CVE-2007-4997

CVE-2007-4997 affects the Linux kernel 2.6.x, including components in net/ieee80211/ieee80211_rx.c, where an off-by-two integer underflow in ieee80211_rx can crash the kernel when a runt IEEE 802.11 frame with the IEEE80211_STYPE_QOS_DATA flag is used. Impact is remote denial of service (kernel c...

CVE-2009-1633

The CVE-2009-1633 issue affects the Linux kernel CIFS subsystem prior to 2.6.29.4. It describes multiple buffer overflows in CIFS that can be triggered by a malformed Unicode string (Unicode string area alignment in fs/cifs/sess.c) or long Unicode characters (fs/cifs/cifssmb.c and fs/cifs/readdir...

CVE-2009-2407

CVE-2009-2407 describes a heap-based buffer overflow in the parse_tag_3_packet function of fs/ecryptfs/keystore.c in the Linux kernel’s eCryptfs subsystem, exploitable via a crafted eCryptfs file. The issue affects Linux kernels before 2.6.30.4 and can lead to a denial of service (system crash) o...

CVE-2010-2066

CVE-2010-2066 affects the Linux kernel up to version 2.6.34. The flaw is in fs/ext4/move_extent.c: the mext_check_arguments routine, which can allow a local attacker to overwrite an append-only file when using the MOVE_EXT ioctl and designating that file as the donor. The issue arises from insuff...

CVE-2010-3079

CVE-2010-3079 affects the Linux kernel up to version 2.6.35.4, specifically in kernel/trace/ftrace.c when debugfs is enabled. The issue arises from interaction between mutex possession and llseek, causing a NULL pointer dereference and outage of all ftrace-related files, leading to a local DoS. A...

CVE-2010-4162

CVE-2010-4162: Linux kernel before 2.6.36.2 contains multiple integer overflows in fs/bio.c that allow local users to cause a denial of service (system crash) via a crafted device ioctl to a SCSI device. MiracleLinux AXSA:2011-57 lists CVE-2010-4162 among affected kernel issues and references a f...

CVE-2012-6704

CVE-2012-6704 affects the Linux kernel prior to 3.5. The sock_setsockopt path in net/core/sock.c mishandles negative values for sk_sndbuf/sk_rcvbuf, enabling a local attacker with CAP_NET_ADMIN to trigger memory corruption and a possible denial of service (memory corruption/system crash). Affecte...

CVE-2013-2850

CVE-2013-2850: Heap-based buffer overflow in the Linux kernel’s iSCSI target subsystem (iscsi_add_notunderstood_response in drivers/target/iscsi/iscsi_target_parameters.c) affects kernel versions up to 3.9.4. The flaw can allow remote attackers to trigger memory corruption and OOPS, with potentia...

CVE-2014-2038

CVE-2014-2038 affects the Linux kernel via the nfs_can_extend_write flaw in fs/nfs/write.c (before 3.13.3). The vulnerability relies on a write delegation to extend a write operation without an up‑to‑date verification, enabling local attackers to obtain sensitive kernel memory data by writing to ...

CVE-2014-2672

CVE-2014-2672 : A race condition in the Linux kernel’s ath9k driver (ath_tx_aggr_sleep in drivers/net/wireless/ath/ath9k/xmit.c) before 3.13.7 can be triggered by a high volume of network traffic, enabling remote attackers to cause a denial of service (system crash). Public sources in connected d...

CVE-2014-9710

CVE-2014-9710 affects the Linux kernel’s Btrfs xattr handling prior to 3.19. The vulnerability arises because the visible xattr state may not be consistent with a requested replacement, enabling local attackers to bypass ACLs and gain privileges through standard filesystem operations during an xa...

CVE-2015-7509

Summary (CVE-2015-7509 + related advisory) The issue affects the Linux kernel’s ext4/namei.c logic for non-journal filesystems. In kernels before 3.7.3, the ext4_orphan_del/ orphan-list handling can be bypassed by crafted filesystems, allowing physically proximate attackers to trigger a denial of...

CVE-2016-2853

CVE-2016-2853 – Linux kernel aufs Privilege Escalation : The vulnerability arises in the aufs module (Linux kernel 3.x/4.x) where mount namespace restrictions are insufficient. A local attacker can mount an aufs filesystem atop a FUSE filesystem and, by executing a crafted setuid program, escalat...

CVE-2016-4951

CVE-2016-4951 refers to a vulnerability in the Linux kernel (tipc_nl_publ_dump in net/tipc/socket.c) present up to version 4.6. The function does not verify socket existence, allowing a local attacker to trigger a denial of service via a NULL pointer dereference that can crash the system, potenti...

CVE-2019-18812

CVE-2019-18812 corresponds to a memory-leak vulnerability in the Linux kernel’s sof_dfsentry_write() (sound/soc/sof/debug.c). The issue, present in kernel builds up to 5.3.9, can be exploited to cause a denial of service via memory consumption. The connected Nessus advisories (Unity Linux UTSA-20...

CVE-2021-47054

The CVE-2021-47054 issue is a Linux kernel vulnerability in the bus/qcom subsystem where a reference count leak could occur if the loop using for_each_available_child_of_node() is broken. The fix ensures the child node is put before returning, correcting manual decrement paths for the child when ...

CVE-2021-47066

CVE-2021-47066 describes a Linux kernel vulnerability in async_xor handling where an incorrect xor value is computed when dropping a destination page due to not updating src_offs alongside src_list. The root cause is that the xor value uses offsets per r5dev, and the patch sequence now records mu...

CVE-2021-47165

CVE-2021-47165 relates to the Linux kernel drm/meson shutdown crash when the main component is not probed (e.g., dw-hdmi not loaded or probe deferred). The issue causes a NULL dereference during shutdown, shown in meson_drv_shutdown and related shutdown paths. The fix described across sources is ...

CVE-2021-47170

CVE-2021-47170 (Linux kernel) is described in the initial document as a benign user‑request issue where usbfs would emit a WARN when a user submits an excessively large memory allocation for bulk transfers. The vulnerability is not a flaw in kernel logic, but a misinterpretation of invalid reques...

CVE-2021-47176

CVE-2021-47176 affects the Linux kernel s390/dasd subsystem. The issue arises from an omitted discipline function, leading to a panic when the path verification function is invoked for FBA or DIAG devices. A fix defines a wrapper for dasd_generic_verify_path() to restore correct operation and pre...

CVE-2021-47320

CVE-2021-47320 is a Linux kernel vulnerability describing an ACL memory leak in the NFS code path. The issue centers on leaked entries in acl memory when creating posix_acl_create() paths, specifically in the NFS routines nfs3_proc_create() and nfs3_proc_mknod() error handling. The connected Ness...

CVE-2021-47366

Summary (CVE-2021-47366) : In the Linux kernel AFS client vulnerability, reads from an OpenAFS server could be corrupted when file positions or read lengths exceeded 2G, due to switching between FS.FetchData (signed 32-bit pos/len) and FS.FetchData64. The fix captures file server capabilities via...

CVE-2022-49159

CVE-2022-49159 affects the Linux kernel SCSI driver qla2xxx (SRB refcounting). The issue arises from a race between the timeout path and the normal completion path, where qla24xx_async_abort_cmd() could access a freed sp->qpair pointer, risking a kernel NULL pointer dereference. The documented...

CVE-2022-49185

The CVE-2022-49185 entry concerns a Linux kernel pinctrl nomadik issue where of_node_put() was missing in nmk_pinctrl_probe, risking a refcount leak. The fix adds a call to of_node_put() to balance the refcount returned by of_parse_phandle(), as described across connected advisories (Astra Linux,...

CVE-2022-49248

CVE-2022-49248 relates to the Linux kernel ALSA: firewire-lib, where the deferrable AV/C transaction flag could be left uninitialized for non-control/notify AV/C transactions. UBSAN reported an invalid-load in fcp.c when handling AV/C responses, with the status flag being read as a boolean. The i...

CVE-2022-49508

CVE-2022-49508 affects the Linux kernel HID elan driver. The issue was a potential double free in elan_input_configured because input may be freed explicitly via input_free_device() even though the device is managed by devm_input_allocate_device(). The devm framework guarantees automatic cleanup ...

CVE-2022-49701

The CVE-2022-49701 entry documents a Linux kernel issue in the ibmvfc SCSI driver where queue resources (sub-queues and event pool) are allocated/freed on every CRQ connection event (e.g., reset, LPM) instead of only during probe/remove. This can cause memory inefficiency, potential allocation fa...