CVE-2022-49729

CVE-2022-49729 affects the Linux kernel’s nfcmrvl NFC driver. The issue is a memory leak in nfcmrvl_play_deferred caused by submitting deferred URBs directly via usb_submit_urb and then unanchoring them, which could prevent proper unref and leak memory. The fix, as described in connected advisori...

CVE-2022-50006

CVE-2022-50006 affects the Linux kernel in NFSv4.2 handling of __nfs42_ssc_open. The issue arises when a destination server processes a COPY and should not accept a passed filehandle if it’s not a regular filehandle; additionally, if alloc_file_pseudo() fails, the kernel must drop the reference t...

CVE-2022-50151

CVE-2022-50151 concerns a Linux kernel issue in usb: cdns3 where a kmalloc call uses GFP_DMA32 flags when allocating a page for a DMA pool, triggering a warning like “Unexpected gfp: GFP_DMA32” and a corrective log. The root cause is the mixing of GFP_DMA32 with dma_pool_alloc/dma_alloc_coherent ...

CVE-2023-2430

CVE-2023-2430 concerns the Linux kernel io_uring IOPOLL path. The root cause is a missing lock in io_cqring_event_overflow(), allowing a locally privileged user to trigger a Denial of Service via the io_uring subsystem. Public advisories (Debian, SUSE, Amazon Linux) indicate patches exist in upda...

CVE-2023-52525

CVE-2023-52525 affects the Linux kernel mwifiex wireless driver. The root cause is an out-of-bounds/overshoot check in mwifiex_process_rx_packet; the patch tightens the condition so the code path that accesses RFC1042 headers is skipped when the buffer is too small, allowing packets to be process...

CVE-2024-26745

CVE-2024-26745 pertains to the Linux kernel on pSeries POWER systems where the IOMMU table is not initialized for kdump over SR-IOV, causing a NULL pointer dereference when the kdump kernel initializes IOMMU/TCEs for SR-IOV devices. The root cause is IOMMU table initialization logic that only con...

CVE-2024-26833

CVE-2024-26833 : In the Linux kernel, the drm/amd/display memory-leak issue was caused by not freeing memory for dmub_srv after its destruction. The backtrace implicates dmub_sw_init and related AMDGPU initialization paths, with an unfreed object after dmub_srv destruction. The advisory’s fix is ...

CVE-2024-35799

CVE-2024-35799 relates to the Linux kernel, specifically the DRM/AMD display path. The issue occurs when disabling a stream encoder, where a function invoked during disable no longer exists. The fix adds a null-check for the function declaration in the disable-stream encoder path to prevent a cra...

CVE-2024-35921

CVE-2024-35921 affects the Linux kernel media/mediatek vcodec HEVC decoding path. The stateless HEVC decoder stored the instance pointer in the context even on initialization failure, leading to a use-after-free when the pointer was freed during deinit. The documented workaround is to store the i...

CVE-2024-35926

CVE-2024-35926 : In the Linux kernel, the crypto IA A group fixes an async_disable descriptor leak in the iaa_compress/decompress paths. The root cause was that disable_async paths did not free idxd descriptors, leaking resources in tests where req->dst is null. A patch adds a proper free, res...

CVE-2024-36018

CVE-2024-36018 : In the Linux kernel, the remap operation for nouveau/uvmm had incorrect addr/range calculations, causing an unmap from 0x3fffed0000+0xf0000 and a 0x100000 range to corrupt pagetables and oops the kernel. The fix changes the calculations to use explicit start/end and then maps bac...

CVE-2024-36023

CVE-2024-36023 is a Linux kernel vulnerability involving a null pointer dereference. The alteration was reported by Julia Lawall and has been resolved in the kernel code base, as reflected by the linked advisories and the CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) with a base score of 5.5 ...

CVE-2024-38628

CVE-2024-38628 affects the Linux kernel usb gadget: u_audio component. A race condition use-after-free occurs with controls during gadget unbind. The fix keeps control IDs (not pointers) and uses proper locking to avoid use-after-free when unbinding gadget. Connected MSRC entry confirms the issue...

CVE-2024-39477

CVE-2024-39477 is a Linux kernel vulnerability affecting the mm/hugetlb path. The issue occurred when vma_needs_reservation() could return -ENOMEM if allocate_file_region_entries() failed to allocate the file_region struct for a reservation, causing a splat on __unmap_hugepage_range(). The mitiga...

CVE-2024-42135

CVE-2024-42135 concerns the Linux kernel vhost_task handling of SIGKILL. The connected sources confirm a concrete fix: when a SIGKILL is issued, the kernel now (1) marks the worker as killed to prevent new virtqueue usage and new flush operations, (2) fixes the virtqueue-to-worker mapping to stop...

CVE-2024-43864

CVE-2024-43864: In the Linux kernel mlx5e CT entry update path, a failure to allocate a new modify header could leave the old header pointer invalid, risking a panic when the old header is freed and potentially leaking the modify header context. The fix restores the old attr to attr on allocation...

CVE-2024-46808

CVE-2024-46808 affects the Linux kernel component drm/amd/display, where a missing NULL pointer check in dpcd_extend_address_range can lead to an assertion if kcalloc returns NULL. The connected Nessus entry confirms the vulnerability exists in Linux distros without a vendor patch and cites the s...

CVE-2024-46824

Summary (CVE-2024-46824) The connected MiracleLinux/MiracleLinux AXSA advisory AXSA:2024-9508:43 for MiracleLinux 9 ( kernel 5.14.0-503.14.1.el9_5 ) explicitly lists CVE-2024-46824 among the vulnerabilities. The advisory notes that the issue affects iommufd: drivers must supply the cache_invalida...

CVE-2024-50165

CVE-2024-50165 concerns the Linux kernel BPF subsystem. The vulnerability arises in bpf_parse_param() where param->string was not preserved, risking a kmalloc leak if the string is later freed. The fix is to preserve the value of param->string so it can be freed correctly, preventing memory...

CVE-2024-56552

Technical details about CVE-2024-56552 are not provided in the supplied documents. Please monitor for updates from kernel patch notes and security advisories.

CVE-2024-56784

Technical details for CVE-2024-56784 are not provided in the connected documents. The initial description notes a Linux kernel drm/amd/display fix, but explicit affected versions, root cause specifics, exploitability, or remediation are not disclosed here. Monitor for updates.

CVE-2024-57998

The CVE-2024-57998 issue affects the Linux kernel OPP (Operating Performance Points) subsystem. The vulnerability arises from a lack of proper index validation when reading the opp->rates[] table in _read_freq(), which could lead to a buffered read overflow. The patch adds an index parameter t...

CVE-2024-58081

CVE-2024-58081 : In the Linux kernel, a race/ordering flaw in the power-domain (GENPD) debug path can dereference NULL if the genpd struct device name isn’t set before pm_genpd_init() runs. The issue arises when dev_set_name() for the GENPD device occurs inside pm_genpd_init(), and a NULL genpd n...

CVE-2025-21661

CVE-2025-21661 concerns the Linux kernel GPIO virtuser path (gpio-virtuser.c). When a virtuser device is created via configfs and probe fails due to an incorrect lookup table, the table was not cleaned up, blocking subsequent probes and potentially requiring device release to recover. A memory le...

CVE-2025-21973

CVE-2025-21973 affects the bnxt Ethernet driver (bnxt_get_queue_stats_rx/tx) in the Linux kernel. If an interface is down, qstats-get may access cp_ring/tx_ring without null checks, causing a NULL pointer dereference and kernel panic. Reproducer steps are provided in the description. The issue ha...

CVE-2025-22074

The CVE-2025-22074 issue concerns the ksmbd component in the Linux kernel where r_count increments are not paired with decrements except when an oplock break wait occurs. This can make r_count go negative, which may prevent the ksmbd thread from terminating. Technical detail confirmed in connecte...

CVE-2025-37776

CVE-2025-37776 : In the Linux kernel, ksmbd has a use-after-free in smb_break_all_levII_oplock() caused by a race when unlocking in the middle of the loop. A patch adds a read lock to protect the whole loop. This vulnerability has a local attack vector with high impact (C/H/I/A) per CVSS v3.1, an...

CVE-2025-37872

CVE-2025-37872 : Linux kernel fix in net: txgbe driver. The vulnerability arises when txgbe_sw_init() succeeds but error paths in txgbe_probe() fail, leaving wx->rss_key allocated (wx_init_rss_key()) and not freed, potentially leaking memory. The patch ensures rss_key is freed on error paths a...

CVE-2025-37882

CVE-2025-37882 relates to a Linux kernel isochronous xHCI Ring handling race. The fix changes how xrun events are processed so that a TD queued at a ring position isn’t prematurely completed or warned about when the event TRB pointer can be NULL or a no-op. Triggering conditions include higher IR...

CVE-2025-37912

CVE-2025-37912 affects the Linux kernel ICE driver. The root cause is a missing null pointer check on the value returned by ice_get_vf_vsi(), which could lead to using a NULL VSI pointer in ice_vc_add_fdir_fltr(). The fix, described in commit baeb705fd6a7 ("ice: always check VF VSI pointer values...

CVE-2025-37954

CVE-2025-37954 affects the Linux kernel SMB client path, specifically a race in find_or_create_cached_dir/open_cached_dir. A valid cfid returned during find_or_create_cached_dir could race with a lease-break, causing open_cached_dir to treat the cfid as invalid and potentially leak a dentry refer...

CVE-2025-37961

The CVE-2025-37961 entry describes a Linux kernel issue in the IP virtual server (ip_vs) path. A use of an uninitialized saddr argument in do_output_route4 could affect routing decision, potentially impacting connectivity for tunneled paths. The root cause is reading saddr despite an input that s...

CVE-2025-37987

The CVE-2025-37987 entry refers to a Linux kernel vulnerability in pds_core: adminq overflow/stuck condition. The issue arises because the FW-backed adminq queue can become blocked when multiple adminq commands are posted, as completions occur in a different context. The advisory states the fix r...

CVE-2025-38085

The CVE-2025-38085 entry concerns a race in the Linux kernel mm/hugetlb path. Specifically, huge_pmd_unshare() could drop a reference on a page table that might already be shared across processes, potentially turning it into a normal page table in another process and allowing unrelated VMAs to be...

CVE-2025-38129

CVE-2025-38129 details a Linux kernel use-after-free in page_pool_recycle_in_ring, linked to page_pool's per-CPU recycle mechanism. The root cause is that a page may be freed while the page pool’s ring is still being recycled, resulting in a potential use-after-free when the producer_lock is not ...

CVE-2025-38212

CVE-2025-38212 affects the Linux kernel IPC subsystem. The bug was a use-after-free in radix_tree_node_free triggered by idr_for_each() not being in an RCU read-critical region when called from shm_destroy_orphaned(), risking reading freed memory during radix_tree_for_each_slot(). The fix adds RC...

CVE-2025-38239

CVE-2025-38239 affects the Linux kernel megaraid_sas driver. On systems with DRAM interleave enabled, an out-of-bounds access can occur due to an invalid node index in megasas_alloc_irq_vectors during megaraid_sas probing, which triggers UBSAN reports (array-index-out-of-bounds in topology.h: ind...

CVE-2025-38617

The CVE-2025-38617 issue affects the Linux kernel’s network packet path: a race between packet_set_ring() releasing po->bind_lock and packet_notifier() processing NETDEV_UP can allow a not-hooked socket to be re-registered during the lock window. The root cause is a synchronization race in the...

CVE-2026-53362

Summary (CVE-2026-53362) The Linux kernel vulnerability affects the IPv6 code path in __ip6_append_data() when using the paged-allocation path with MSG_MORE and MSG_SPLICE_PAGES. The fragfrag accounting for fraggap was incorrect: when fraggap is non-zero, pagedlen is overstated and the copied fra...

CVE-2004-1335

The CVE-2004-1335 entry describes a memory leak in the Linux kernel’s ip_options_get function (pre-2.6.10) that can cause local denial of service via repeated ip_cmsg_send calls. Affected component is the kernel networking stack; impact is partial availability due to memory exhaustion. The vulner...

CVE-2006-1864

CVE-2006-1864: Directory traversal in smbfs (Linux kernel 2.6.16 and earlier) lets a local user escape chroot restrictions for an SMB-mounted filesystem via "..\" sequences. Severity: CVSS v2 base 4.6 (Medium); vectors indicate LOCAL access with low complexity and partial confidentiality/integrit...

CVE-2006-2932

CVE-2006-2932 is a regression in the restore_all code path of the 4/4GB split support for non-hugemem kernels in Red Hat Enterprise Linux 4 (Desktop/Enterprise) that allows a local user to cause a denial of service (panic) via unspecified vectors. The issue is documented in Red Hat advisories RHS...

CVE-2008-5079

CVE-2008-5079 affects the Linux kernel ATM subsystem, specifically net/atm/svc.c in 2.6.27.8 and earlier. A local attacker can cause a denial of service (kernel infinite loop) by performing two calls to svc_listen on the same socket and then reading a /proc/net/atm/*vc file, which relates to corr...

CVE-2008-5300

CVE-2008-5300 affects the Linux kernel (example reference in CVE-2008-5300 entry) where local users can cause a denial of service by issuing a large number of sendmsg calls; the trigger is that AF_UNIX garbage collection does not block, leading to an OOM and process loss. The connected advisories...

CVE-2009-0031

CVE-2009-0031 affects Linux kernel 2.6.29-rc2 and earlier, caused by a memory leak in keyctl_join_session_keyring (security/keys/keyctl.c) that can allow local users to consume kernel memory and trigger a denial of service. Root cause described as a missing kfree. Connected advisories (e.g., RHSA...

CVE-2011-1170

CVE-2011-1170 affects the Linux kernel prior to 2.6.39 where net/ipv4/netfilter/arp_tables.c does not place the expected null terminator at the end of certain string values. This can allow a local user with CAP_NET_ADMIN to craft a request and read the argument to the modprobe process, potentiall...

CVE-2011-2689

The vulnerability CVE-2011-2689 affects the Linux kernel’s gfs2_fallocate path (fs/gfs2/file.c). It occurs in versions before 3.0-rc1, where the size of a chunk allocation may not be a multiple of the filesystem block size. This can allow a local user to trigger a denial of service and system cra...

CVE-2013-2148

CVE-2013-2148: In Linux kernel 3.9.x, fill_event_metadata in fs/notify/fanotify/fanotify_user.c does not initialize a structure member, enabling local users to read kernel memory via a fanotify descriptor; vulnerability affects kernels up to version 3.9.4. No remediation details provided in the d...

CVE-2013-3225

CVE-2013-3225 — Linux kernel local information disclosure . Affected: Linux kernel versions prior to 3.9-rc7, specifically the rfcomm_sock_recvmsg() path in net/bluetooth/rfcomm/sock.c. Root cause: an uninitialized length variable in recvmsg/recvfrom handling leads to leakage of kernel stack memo...

CVE-2013-4350

CVE-2013-4350 affects the Linux kernel IPv6 SCTP code (net/sctp/ipv6.c) up to version 3.11.1. The vulnerability arises because the data structures and function calls fail to trigger an intended IPsec encryption configuration, enabling remote attackers to sniff traffic and obtain sensitive informa...