CVE-2025-23152

CVE-2025-23152 affects the Linux kernel on arm64, where the bug was in arm64/crc-t10dif: out-of-scope array usage in crc_t10dif_arch(). A fix was applied in the kernel, described as correcting an array used outside its scope. Connected advisories/patch references include kernel commits (stable) a...

CVE-2025-37887

The CVE-2025-37887 issue affects the Linux kernel pds_core driver. The root cause is that when the firmware does not support PDS_CORE_CMD_FW_CONTROL, fw_list is not zero-initialized, causing fw_list.num_fw_slots to hold a garbage value and leading to an out-of-bounds access (fw_list.fw_names[i] w...

CVE-2025-37897

CVE-2025-37897 affects the Linux kernel wifi driver (plfxlc) where plfxlc_mac_release() asserts mac->lock, which is incorrect because mac->lock cannot be held when probe fails or the device is disconnected. The issue can trigger a kernel warning (warning trace shown in the advisory) and is ...

CVE-2025-37960

CVE-2025-37960 affects the Linux kernel memblock memory handling. When memblock_double_array() grows an array and the slab isn’t yet available, memblock_find_in_range() may return a range that hasn’t been accepted, risking a crash during SNP guest boot (illustrated by memcpy_orig stack trace). Th...

CVE-2025-37983

CVE-2025-37983 is a Linux kernel issue where an inode allocation path could leak a dentry due to an OOM related leak in qibfs. The description confirms the vulnerability was resolved by a fix merged in the kernel ("qibfs: fix another leak"). Public connected sources (Azure Linux, Astra Linux, and...

CVE-2025-38348

The CVE-2025-38348 issue is in the Linux kernel wifi driver for the Intersil p54 interface. A malicious USB device could cause a buffer over-read in p54_rx_eeprom_readback() by tampering v1/v2 eeprom length fields, potentially crashing the host. A patch was applied to store the eeprom size in the...

CVE-2025-38449

CVE-2025-38449 affects the Linux kernel’s DRM/GEM subsystem. A GEM handle could be released while the GEM buffer object remains attached to a DRM framebuffer, causing the backing dma-buf to be released and a segmentation fault during subsequent mode-setting (notably with shadow planes during page...

CVE-2025-38568

In the Linux kernel, net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing (CVE-2025-38568). The TCA_MQPRIO_TC_ENTRY_INDEX policy allowed up to TC_QOPT_MAX_QUEUE (16), causing a 4-byte out-of-bounds write in the fp[] stack array. The fix changes the policy to allow only up to TC_QO...

CVE-2026-52933

CVE-2026-52933 affects the Linux kernel’s io_uring/poll component. The root cause is a signed comparison in io_poll_get_ownership() where atomic_read(&req->poll_refs) is compared to IO_POLL_REF_BIAS; when IO_POLL_CANCEL_FLAG (BIT(31)) is set, the value becomes negative, causing the slowpath to...

CVE-2026-53275

CVE-2026-53275 affects the Linux kernel IPv6 multicast path (net/ipv6/mcast.c) during MLD query processing. A pointer to the multicast group address is captured during initial packet parsing but is not reloaded after skb header changes from pskb_may_pull(), leading to a use-after-free in __mld_qu...

CVE-2008-2544

CVE-2008-2544 describes a local bypass where mounting the /proc filesystem inside a chroot can occur in read-write mode, allowing a user to bypass the chroot and gain write access to files they would not normally access. The connected documents reiterate the same description but do not provide pr...

CVE-2008-4210

CVE-2008-4210 affects the Linux kernel prior to 2.6.22. fs/open.c does not properly strip setuid/setgid bits on writes, allowing local users to gain privileges of a different group and access sensitive information by creating an executable file in a setgid directory via truncate/ftruncate with me...

CVE-2008-4933

CVE-2008-4933: Buffer overflow in hfsplus_find_cat (fs/hfsplus/catalog.c) of the Linux kernel prior to 2.6.28-rc1. An invalid catalog namelength field in an hfsplus filesystem image can cause memory corruption and potentially a denial of service (memory corruption or system crash). Root cause cit...

CVE-2009-4138

CVE-2009-4138 affects Linux kernels with the FireWire OHCI driver (drivers/firewire/ohci.c) prior to 2.6.32-git9. In packet-per-buffer mode, a local user can trigger a NULL pointer dereference via an ioctl associated with receiving an ISO packet with a zero payload-length field, potentially leadi...

CVE-2010-2954

The CVE-2010-2954 issue affects the Linux kernel IRDA stack: irda_bind in net/irda/af_irda.c may dereference a NULL pointer when irda_open_tsap fails, causing local denial of service (kernel panic) via repeated unsuccessful binds on AF_IRDA (PF_IRDA) sockets. Affected software is the Linux kernel...

CVE-2010-2955

The CVE-2010-2955 issue affects the Linux kernel before 2.6.36-rc3-next-20100831, specifically the cfg80211_wext_giwessid function in net/wireless/wext-compat.c, which fails to initialize certain structure members. This enables a local attacker to exploit an off-by-one error in ioctl_standard_iw_...

CVE-2010-3874

CVE-2010-3874: Heap-based buffer overflow in the bcm_connect function of net/can/bcm.c (Broadcast Manager) in the Linux kernel CAN implementation. Affects 64-bit kernels, before 2.6.36.2, enabling local attackers to cause memory corruption and a denial of service via a connect operation. The conn...

CVE-2010-4175

Technical details for CVE-2010-4175 are not provided in the supplied documents; monitor for updates.

CVE-2010-4263

The CVE-2010-4263 issue involves the Intel igb driver (drivers/net/igb/igb_main.c) in the Linux kernel and its handling of VLAN-tagged frames when SR-IOV and promiscuous mode are enabled but no VLANs are registered. In kernels before 2.6.34, processing such frames could trigger a NULL pointer der...

CVE-2010-4527

The CVE-2010-4527 entry concerns the Linux kernel OSS sound driver (load_mixer_volumes in sound/oss/soundcard.c). It arises because a name field is not guaranteed to end with a NUL, enabling a local user to trigger a buffer overflow via SOUND_MIXER_SETLEVELS, with potential to escalate privileges...

CVE-2011-0695

CVE-2011-0695 is a race condition in the Linux kernel’s InfiniBand driver (cm_work_handler in drivers/infiniband/core/cma.c) on 2.6.x. The issue allows remote attackers to trigger a denial of service (panic) by issuing an InfiniBand request while other request handlers are active, causing an inva...

CVE-2012-2123

CVE-2012-2123 affects the Linux kernel up to version 3.3.3, where cap_bprm_set_creds in security/commoncap.c mishandles file-system capabilities (fcaps) for implementing a privileged executable. This can let local users bypass personality restrictions via a crafted application, demonstrated by an...

CVE-2013-1763

CVE-2013-1763 affects the Linux kernel pre-3.7.10, where an array index error in net/core/sock_diag.c (__sock_diag_rcv_msg) could allow a local attacker to gain privileges via a large family value in a Netlink message. The impact is a local privilege escalation with full confidentiality/integrity...

CVE-2013-2147

CVE-2013-2147 affects the Linux kernel drivers for HP Smart Array/Compaq SMART2 (cpqarray/cciss). The root cause is uninitialized data structures in ida_locked_ioctl (via /dev/ida) and cciss_ioctl32_passthru (via /dev/cciss), allowing local attackers to read kernel memory how? through crafted IDA...

CVE-2013-2851

CVE-2013-2851 is a concrete vulnerability in the Linux kernel: a format-string flaw in the register_disk function (block/genhd.c) that affects kernels up to 3.9.4. It enables a local attacker with root access to gain privileges by writing format specifiers to /sys/module/md_mod/parameters/new_arr...

CVE-2013-7270

The CVE-2013-7270 issue affects the Linux kernel prior to 3.12.4, where packet_recvmsg in net/packet/af_packet.c updates a length value before initializing an associated data structure. This can enable local attackers to read kernel memory via recvfrom, recvmmsg, or recvmsg. Remediation is to upg...

CVE-2014-0206

CVE-2014-0206 is an array index error in aio_read_events_ring (fs/aio.c) of the Linux kernel up to version 3.15.1. It enables local users to read sensitive data from kernel memory by supplying a large head value. The provided connected documents confirm the affected file and vulnerability type bu...

CVE-2014-3534

CVE-2014-3534 (Linux kernel, s390) : The vulnerability in arch/s390/kernel/ ptrace.c allows a local user to bypass restrictions on address-space control with PTRACE_POKEUSR_AREA, gaining read/write access to kernel memory and potentially elevation of privileges via a crafted ptrace call. Affected...

CVE-2015-4002

CVE-2015-4002 affects the OZWPAN driver in the Linux kernel (drivers/staging/ozwpan/ozusbsvc1.c) up to version 4.0.5. The issue is a length-value handling flaw where certain length values are not sufficiently large, enabling remote attackers to cause a denial of service (system crash or large loo...

CVE-2015-4170

CVE-2015-4170 describes a race condition in the Linux kernel’s tty shutdown path: in ldsem_cmpxchg() within drivers/tty/tty_ldsem.c, allowing a local user to trigger a deadlock (ldsem_down_read/ldsem_down_write) by starting a new tty thread during shutdown of a previous one. The affected codebase...

CVE-2016-5728

CVE-2016-5728 is a local-privilege vulnerability in the Linux kernel MIC VOP driver (drivers/misc/mic/vop/vop_vringh.c). The race condition occurs in vop_ioctl where the driver performs two successive reads from user space to read a variable-length data structure, enabling a local user to either ...

CVE-2018-7273

CVE-2018-7273 affects the Linux kernel floppy driver. The show_floppy path in drivers/block/floppy.c prints kernel addresses via printk, enabling local attackers to read addresses from dmesg and locate kernel code/data, potentially bypassing KASLR. The vulnerability is described for Linux kernels...

CVE-2021-47010

In the Linux kernel, the following vulnerability has been resolved: net: Only allow init netns to set default tcp cong to a restricted algo tcp_set_default_congestion_control() is netns-safe in that it writesto &net->ipv4.tcp_congestion_control, but it also setsca->flags |= TCP_CONG_NON_RES...

CVE-2021-47045

CVE-2021-47045 affects Linux kernel SCSI lpfc (lpfc_prep_els_iocb). The vulnerability arises when lpfc_issue_els_plogi() is called with a did that has no matching ndlp, causing a NULL pointer dereference to lpfc_nodelist. The fix returns an error status if no valid ndlp is found and updates ndlp ...

CVE-2021-47142

CVE-2021-47142 affects the Linux kernel DRM/AMDGPU stack. The vulnerability arises from a use-after-free in the amdgpu_ttm_backend path when unbinding/destroying TTM memory; the code forgets to null out ttm->sg, leading to a crash (general protection fault) during sg_free_table and related cle...

CVE-2021-47181

The CVE-2021-47181 issue affects the Linux kernel code path for usb: musb: tusb6010. The root cause is a missing NULL check after platform_get_resource(), which can lead to a NULL pointer dereference if platform_get_resource() returns NULL. Public sources describe the vulnerability and impact as ...

CVE-2021-47182

The CVE-2021-47182 entry concerns the Linux kernel scsi_mode_sense() implementation. Affected component: scsi core. Issues: improper handling of the MODE SENSE(10) allocation length field (16-bit, truncating lengths >255) and buffer length adjustments that could corrupt memory when len is too ...

CVE-2021-47407

The CVE-2021-47407 issue is in the Linux kernel's KVM x86 code related to SRCU initialization during page track setup. The root cause is a missing validation of init_srcu_struct()’s return value, which can fail (e.g., due to OOM) and lead to a NULL pointer dereference found by a modified syzkalle...

CVE-2021-47590

CVE-2021-47590 affects the Linux kernel MPTCP path. The deadlock occurs when __mptcp_push_pending() calls mptcp_flush_join_list() while holding the subflow socket lock, enabling __mptcp_sockopt_sync() to lock the subflow socket. The fix uses __mptcp_flush_join_list() (not plain mptcp_flush_join_l...

CVE-2021-47631

CVE-2021-47631 affects the Linux kernel (ARM: da850-evm path) where a NULL pointer dereference could occur in da850_evm_config_emac() during boot on palmetto-bmc/QEMU setups. The root cause is emac_pdata being NULL because davinci_soc_info is populated only on Davinci machines, while the function...

CVE-2021-47644

CVE-2021-47644 affects the Linux kernel where the “media: staging: media: zoran” code path was updated to move videodev allocation out of zr36057_init() and create new handling functions for zr->video_dev. The change fixes a memory leak in zr->video_dev and improves code readability. The vu...

CVE-2022-48631

The CVE-2022-48631 issue affects the Linux kernel’s ext4 extents parsing. Specifically, ext4_ext_binsearch_idx() could operate on an extent header with eh_depth > 0 when eh_entries is 0, leading to garbage indices and kernel crash (BUG at fs/ext4/extents.c:2258) observed in the provided traces...

CVE-2022-48799

CVE-2022-48799 corresponds to a Linux kernel perf subsystem issue: list corruption in perf_cgroup_switch() affecting the cgrp_cpuctx_list during event removal. The root cause is a risky iteration over a list while removing entries; the recommended fix is to replace list_for_each_entry with list_f...

CVE-2022-48842

CVE-2022-48842 describes a race in the Linux kernel ice driver during interface enslave (bonding). The vulnerability occurs when an auxiliary device is re-created: ice_plug_aux_dev() is invoked from ice_service_task() context, potentially creating an aux device while another thread holds RTNL loc...

CVE-2022-48977

The CVE-2022-48977 vulnerability affects the Linux kernel CAN subsystem. It fixes a NULL pointer dereference in can_rcv_filter, triggered by missing initialization of ml_priv in the receive path for CAN frames. The issue arises because dev->type may be ARPHRD_CAN in CAN-capable devices, but so...

CVE-2022-48985

CVE-2022-48985 : Linux kernel net: mana driver race on per-CQ variable napi_work_done. After napi_complete_done(), NAPI_F_STATE_SCHED may be cleared, letting another CPU run a napi thread and access cq->work_done; if that thread sets it to >= budget, it may continue to run and cause memory ...

CVE-2022-49139

CVE-2022-49139 affects the Linux kernel Bluetooth stack. The issue occurs in the HCI handling path: upon receiving a HCI_Synchronous_Connection_Complete for a BDADDR of an existing LE connection, with LE link type and a status triggering the second packet-processing case, a NULL pointer dereferen...

CVE-2022-49219

CVE-2022-49219 concerns a memory-leak in the Linux kernel VFIO PCI driver during D3hot↔D0 transitions. If vfio_pci_core_device::needs_pm_restore is set, the current PCI state is saved in pm_save on D0→D3hot and would be restored on D3hot→D0. The code uses pci_store_saved_state() to save state and...

CVE-2022-49247

CVE-2022-49247 – Linux kernel media stk1160 issue : The vulnerability concerns the stk1160 driver in the Linux kernel’s videobuf2 path. When start_streaming fails, the driver previously returned all queued buffers with VB2_BUF_STATE_ERROR, but it should have returned them with VB2_BUF_STATE_QUEUE...

CVE-2022-49368

CVE-2022-49368 relates to a Linux kernel out-of-bounds read in net: ethernet: mtk_eth_soc, triggered by an invalid fsp->location that comes from user via ethtool_get_rxnfc(). The vulnerability is fixed by validating the location parameter to prevent the read, with upstream kernel patches refer...