15062 matches found
CVE-2024-35799
CVE-2024-35799 relates to the Linux kernel, specifically the DRM/AMD display path. The issue occurs when disabling a stream encoder, where a function invoked during disable no longer exists. The fix adds a null-check for the function declaration in the disable-stream encoder path to prevent a cra...
CVE-2012-3430
CVE-2012-3430 : In the Linux kernel before 3.0.44, the function rds_recvmsg in net/rds/recv.c fails to initialize a structure member, allowing a local attacker to read potentially sensitive kernel stack memory via recvfrom or recvmsg on an RDS socket. Impact: information disclosure. Affected: Lin...
CVE-2012-6544
CVE-2012-6544 affects the Linux kernel Bluetooth stack prior to 3.6. The issue arises from improper initialization of certain structures in the L2CAP/HCI paths, enabling a local attacker to read sensitive data from kernel stack memory via a crafted application. MiracleLinux AXSA-2014-258 (kernel-...
CVE-2013-1796
CVE-2013-1796 affects the Linux kernel KVM MSR_KVM_SYSTEM_TIME handling: the kvm_set_msr_common path in arch/x86/kvm/x86.c does not ensure time_page alignment for MSR_KVM_SYSTEM_TIME when the kernel is
CVE-2013-7266
CVE-2013-7266 affects the Linux kernel code path in drivers/isdn/mISDN/socket.c up to version 3.12.3. The function mISDN_sock_recvmsg does not consistently validate length against the related data structure, enabling local attackers to read kernel memory via (1) recvfrom, (2) recvmmsg, or (3) rec...
CVE-2014-0155
The CVE-2014-0155 entry concerns the Linux kernel up to 3.14.1, where the ioapic_deliver function in virt/kvm/ioapic.c does not properly validate the return value of kvm_irq_delivery_to_apic. This can allow a guest OS user to trigger a host OS denial of service (host crash) via a crafted entry in...
CVE-2014-1438
The CVE-2014-1438 entry concerns the Linux kernel prior to 3.12.8 on AMD K7/K8 platforms. The restore_fpu_checking function in arch/x86/include/asm/fpu-internal.h does not clear pending FPU exceptions before an EMMS instruction, enabling local users to cause a denial of service (task kill) or pot...
CVE-2014-1445
Technical details for CVE-2014-1445 are not publicly provided in the supplied documents. The initial description contains core details, but no additional technical specifics are found in connected documents. Monitor for updates.
CVE-2014-4014
The CVE-2014-4014 issue is a Linux kernel local privilege escalation affecting versions before 3.14.8. The root cause is that namespaces are inapplicable to inodes, allowing a local user who creates a user namespace to bypass chmod restrictions by setting the setgid bit on a file with root group ...
CVE-2014-8172
CVE-2014-8172 affects the Linux kernel prior to 3.13, where files list handling uses an inappropriate locking approach around Asynchronous I/O (AIO). This local-denial-of-service flaw can cause soft lockups or a system crash. The available documentation confirms the vulnerability and its local at...
CVE-2016-2548
CVE-2016-2548 affects the Linux kernel’s sound/core/timer.c prior to 4.4.1. The issue arises because the kernel may retain certain linked lists after a close or stop action (snd_timer_close and _snd_timer_stop), enabling a local attacker to trigger a denial-of-service (system crash) via a crafted...
CVE-2021-47053
In the Linux kernel, CVE-2021-47053 affects crypto: sun8i-ss where the pad object could leak memory due to several failure return paths not freeing the pad. The issue has been fixed in the kernel (memory leak); patches are available in the linked stableKernel commits. Impact is a resource leak (l...
CVE-2021-47066
CVE-2021-47066 is a Linux kernel issue where async_xor parity calculation failed when sharing pages with different offsets, causing potential data corruption. The root cause was that the calc of xor value used only src_list while the source page offsets (src_offs) were needed when dropping destin...
CVE-2021-47077
CVE-2021-47077 affects the Linux kernel scsi qedf driver. The vulnerability stems from qedf_update_link_speed() dereferencing shost_data when it has not been initialised, causing a NULL pointer dereference and potentially an impact on availability. The fix adds a NULL pointer check before using s...
CVE-2021-47104
The CVE-2021-47104 entry concerns the Linux kernel IB/qib component, specifically a memory leak in qib_user_sdma_queue_pkts(). The root cause is an incorrect goto label used in the error path, which caused cleanup of allocated pkt structures to be skipped, leading to a resource leak. The connecte...
CVE-2021-47484
The Linux kernel contains a vulnerability in the octeontx2-af component where dereferencing a NULL pointer in the rvu_debugfs.c and rvu_nix.c files can occur. Exploitation of this flaw can lead to a denial of service by causing a service failure. This issue is addressed in recent kernel updates, ...
CVE-2021-47490
CVE-2021-47490 affects the Linux kernel DRM memory management (drm/ttm). The issue is a memleak during ttm_transfered_destroy, and the fix includes cleanup of fences for ghost objects. The available connected advisories/policy notes confirm the vulnerability is fixed by kernel patches; no exploit...
CVE-2021-47670
CVE-2021-47670 (can: peak_usb) is a use-after-free in the Linux kernel can subsystem. After peak_usb_netif_rx_ni(skb) is called, the skb may be dereferenced, and the can_frame cf that aliases skb memory can access memory that has been freed. The issue is resolved by reordering code lines to preve...
CVE-2022-20108
CVE-2022-20108 concerns a vulnerability in the voice service where an out-of-bounds write occurs due to a stack-based buffer overflow. The consequence is local escalation of privilege to System level, with no user interaction required for exploitation. Public details consistently describe this as...
CVE-2022-2327
CVE-2022-2327 affects the Linux kernel io_uring path: use of work_flags to determine identity for IORING_OP may cause missing types, leading to incorrect reference counts and a double free. The primary public advisory notes the root cause is in the kernel io_uring identity handling and recommends...
CVE-2022-48688
CVE-2022-48688 covers a Linux kernel i40e driver issue where removing modules after an offline ethtool test could crash the kernel. The root cause reported is that the driver frees the client instance incorrectly; during recursive removal (e.g., irdma removing i40e), i40e_lan_del_device dereferen...
CVE-2022-48744
In CVE-2022-48744, the Linux kernel net/mlx5e driver was made resilient to field-bound checking by avoiding a field-overflowing memcpy() across neighboring fields. The root cause involved copying MLX5E_XDP_MIN_INLINE bytes into a 2-byte inline_hdr.start, causing writes to adjacent data (vlan_tci,...
CVE-2022-48805
CVE-2022-48805 affects the Linux kernel USB driver net: usb: ax88179_178a, specifically the rx_fixup path (ax88179_rx_fixup()). The issue is multiple out-of-bounds accesses in RX fixup that can be triggered by a malicious or defective USB device. Reported problems include: (1) an out-of-bounds me...
CVE-2022-48941
CVE-2022-48941 affects the Linux kernel ice driver handling of Virtual Functions (VFs). The issue arises from a concurrency gap between VF reset and VF removal. The patch that introduced ICE_VF_DEINIT_IN_PROGRESS aimed to prevent issues during teardown but inadvertently caused the PF to stop resp...
CVE-2022-48983
CVE-2022-48983 is a Linux kernel vulnerability where a NULL pointer dereference in io_tctx_exit_cb() could occur during io_uring/cancellation interplay, leading to a kernel panic. The issue arose when task_work added by io_ring_exit_work() could race with cancellation of exec work, causing curren...
CVE-2022-48999
CVE-2022-48999 concerns a Linux kernel issue in IPv4 multipath route deletion. The root cause is a slab-out-of-bounds read in fib_nh_match when deleting a route where fib_info references a nexthop while separate nexthop objects conflict with the legacy multipath spec. The workaround/fix implement...
CVE-2022-49000
CVE-2022-49000 – Linux kernel (iommu/vt-d) refcount leak fix . The issue stems from for_each_pci_dev() implemented via pci_get_device(); the returned pci_dev’s reference count is incremented, but input dev is not always decremented, leading to a potential refcount leak. The patch adds a pci_dev_p...
CVE-2022-49020
In CVE-2022-49020, the Linux kernel’s net/9p code has a socket leak: p9_fd_create_tcp() and p9_fd_create_unix() call p9_socket_open(), and if p9_trans_fd creation fails they return an error without releasing the socket. The root cause is failure to sock_release() the socket, which this patch fixe...
CVE-2022-49074
CVE-2022-49074 concerns the Linux kernel vulnerability in the GICv3 interrupt controller. The issue was caused by incorrect polling of GICR RWP in redistributors, where the code tested the distributor bit index instead of the correct RWP bit, a mistake that reportedly persisted for eight years. T...
CVE-2022-49137
CVE-2022-49137 concerns a refcount leak in the Linux kernel’s amdgpu_cs_fence_to_handle_ioctl() path. When info->in.what hits the default case, the function returns -EINVAL without decrementing the previously bumped dma_fence refcount, causing leaks. The issue arises from a missing refcount de...
CVE-2022-49292
CVE-2022-49292 is tied to the Linux kernel ALSA oss PCM buffer allocation overflow. The vulnerability occurs when snd_pcm_plug_alloc() may allocate an oversized temporary buffer during data conversion if hardware parameters allow larger-than-expected period/buffer sizes, risking an INT_MAX overfl...
CVE-2022-49366
CVE-2022-49366 affects ksmbd in the Linux kernel. The vulnerability arises in smb_check_perm_dacl() when id and uid have the same value, causing a path to exit the loop without decrementing the reference count of the posix_acls object (increased by get_acl()), which may lead to memory leaks. The ...
CVE-2022-49486
CVE-2022-49486 relates to the Linux kernel ASoC driver for i.MX SGTL5000. The vulnerability is a refcount leak in imx_sgtl5000_probe caused by improper handling of a reference taken by of_find_i2c_device_by_node(); in error paths the driver should call put_device() to drop the reference. A resolv...
CVE-2022-49497
CVE-2022-49497 is a Linux kernel issue in the networking code where two BUG() calls were present in skb_checksum_help(). The vulnerability was resolved by removing these BUG()s and replacing them with WARN_ON_ONCE() so skb_checksum_help() can return an error code instead of triggering a crash whe...
CVE-2022-49516
CVE-2022-49516 affects the Linux kernel: the ice network driver could dereference a VSI pointer returned by ice_get_vf_vsi without validating it, which could be NULL in scenarios such as resets when a VSI is removed and recreated. The published fix is to check the return value of ice_get_vf_vsi e...
CVE-2022-49526
CVE-2022-49526 - Linux kernel md/bitmap issue : In clustered MD (md-cluster) setups, the code path md_bitmap_read_sb can permit a faulty bitmap to pass sanity checks, allowing the chunksize to be assigned even when the bitmap data is invalid. This leads to a division error (DIV_ROUND_UP_SECTOR_T)...
CVE-2022-49581
CVE-2022-49581 : In the Linux kernel, the be2net driver had a buffer overflow in be_get_module_eeprom due to improper handling of buffer length in be_cmd_read_port_transceiver_data. The vulnerable path could copy more data than available when the buffer is smaller than PAGE_DATA_LEN (or twice tha...
CVE-2022-49873
The CVE-2022-49873 entry concerns the Linux kernel eBPF verifier. The release_reference() path could leave memory-allocated resources unfreed, causing registers tied to released pointers to be marked as SCALAR_VALUE, which in turn may allow an unprivileged user to observe a kernel pointer when st...
CVE-2022-49940
CVE-2022-49940 concerns the Linux kernel tty/n_gsm subsystem. The vulnerability arises when gsmld_receive_buf() may call gsm->receive() even if gsm->receive is not initialized, leading to a NULL pointer dereference. The fix adds a sanity check to avoid invoking gsm->receive() if the func...
CVE-2023-3389
CVE-2023-3389 (Linux kernel io_uring UAF) : A use-after-free in the io_uring subsystem can be exploited to achieve local privilege escalation. The issue involves racing a io_uring cancel poll request with a linked timeout, which can trigger a UAF in an hrtimer. Impact is local privilege escalatio...
CVE-2023-52829
The connected documents do not provide additional technical details beyond the initial description. Public information on CVE-2023-52829 is not expanded here; monitor for updates.
CVE-2024-26705
The CVE-2024-26705 issue affects the Linux kernel parisc BTLB path during CPU bringup with hotplug for 32-bit CPUs. The crash occurred when querying BTLB information from firmware to set up static TLB entries, because the static btlb_info struct required write access but was marked __ro_after_ini...
CVE-2024-26727
CVE-2024-26727 (Linux kernel, btrfs subvolume creation) Concrete details are present in connected Astra/Linux advisory. The issue arises when creating a new subvolume under btrfs: after inserting the root item, a backref/read could access the subvolume before a preallocated anonymous device (anon...
CVE-2024-35804
CVE-2024-35804 affects the Linux kernel KVM/x86 emulation of atomic CMPXCHG. The root cause was that marking the guest page dirty during emulated atomic access could be dropped when converting the CMPXCHG to a user access, risking guest memory corruption during live migration. The fix ensures the...
CVE-2024-35909
CVE-2024-35909 affects the Linux kernel wwan/t7xx path where 64-bit register accesses could fault due to 32-bit alignment in some 64‑bit platforms. The fix splits 64-bit accesses into 32-bit pairs to ensure proper alignment, preventing OOPS/paging faults as shown in the crash trace. Remediation i...
CVE-2024-35921
CVE-2024-35921 affects the Linux kernel media/mediatek vcodec HEVC decoding path. The stateless HEVC decoder stored the instance pointer in the context even on initialization failure, leading to a use-after-free when the pointer was freed during deinit. The documented workaround is to store the i...
CVE-2024-38617
Technical details about CVE-2024-38617 are not provided in the supplied documents. Monitor for updates from vendor advisories and kernel project commits for affected components and fixed versions.
CVE-2024-41045
CVE-2024-41045: Linux kernel vulnerability fixed in bpf_timer_cancel_and_free. The issue arises when canceling/ freeing timers embedded in BPF maps via bpf_map_update_elem, where timer cancellation uses hrtimer_cancel and could deadlock or cause use-after-free under RCUs. The patch suggests using...
CVE-2024-46785
CVE-2024-46785 affects the Linux kernel, specifically an issue in eventfs relating to SRCU-protected lists. The root cause is a NULL pointer access in tracefs when ei_child can be set to LIST_POISON1 after removal in eventfs_remove_rec, leading to a crash/panic. The vulnerability materializes whe...