CVE-2008-3833

CVE-2008-3833 affects the Linux kernel up to version 2.6.18 (vulnerable in 2.6.18 and earlier) where generic_file_splice_write in fs/splice.c does not properly strip setuid/setgid bits on writes via splice to a file. This allows local users to gain privileges of a different group or access sensit...

CVE-2010-2963

CVE-2010-2963 affects the Linux kernel’s Video4Linux (V4L) implementation on x86_64, where a flaw in the v4l2-compat ioctl32 code fails to validate the destination of a memory copy, enabling a local user to write arbitrary kernel memory via VIDIOCSTUNER on a /dev/video device followed by VIDIOCSM...

CVE-2012-2100

The CVE-2012-2100 issue affects the Linux kernel before 3.2.2, on x86 (and unspecified other) platforms, via the ext4_fill_flex_info function in fs/ext4/super.c. It allows user-assisted remote attackers to trigger inconsistent filesystem-groups data and potentially cause a denial of service throu...

CVE-2012-2744

The vulnerability CVE-2012-2744 affects the Linux kernel (net/ipv6/netfilter/nf_conntrack_reasm.c) when nf_conntrack_ipv6 is enabled. It allows remote attackers to cause a denial of service (NULL pointer dereference and system crash) via certain fragmented IPv6 packets. A fix is available in kern...

CVE-2013-1929

The CVE-2013-1929 issue is a heap-based buffer overflow in the tg3_read_vpd function of the Linux kernel (drivers/net/ethernet/broadcom/tg3.c) prior to 3.8.6. It allows physically proximate attackers to cause a denial of service (system crash) or possibly execute arbitrary code via crafted Vital ...

CVE-2013-2899

CVE-2013-2899 concerns the Linux kernel HID subsystem: the file drivers/hid/hid-picolcd_core.c is vulnerable through kernel version 3.11 when CONFIG_HID_PICOLCD is enabled. The issue allows physically proximate attackers to cause a denial of service via a crafted device, manifested as a NULL poin...

CVE-2014-2568

Use-after-free in Linux kernel: nfqnl_zcopy in nfnetlink_queue_core.c (up to 3.13.6) can leak kernel memory by exploiting missing orphaning; code later moved to skb_zerocopy before the vulnerability was announced. Affected component is the kernel’s net/netfilter/nfnetlink_queue_core.c path; explo...

CVE-2014-3185

CVE-2014-3185 affects the Linux kernel’s Whiteheat USB Serial Driver (drivers/usb/serial/whiteheat.c). The vulnerability allows physically proximate attackers to execute arbitrary code or cause a denial of service (memory corruption and system crash) by presenting a crafted USB device that suppli...

CVE-2014-4667

CVE-2014-4667 affects the Linux kernel: the sctp_association_free function in net/sctp/associola.c before version 3.15.2 fails to properly manage a specific backlog value, enabling remote attackers to trigger a denial of service (socket outage) via a crafted SCTP packet. The vulnerability is root...

CVE-2016-2546

CVE-2016-2546 : In the Linux kernel, sound/core/timer.c uses an incorrect mutex type, enabling local attackers to trigger a denial of service via a crafted ioctl. Root cause is a mutex type misusage that can cause race conditions and use-after-free leading to system crashes. Affected function/fil...

CVE-2018-7273

CVE-2018-7273 affects the Linux kernel floppy driver. The show_floppy path in drivers/block/floppy.c prints kernel addresses via printk, enabling local attackers to read addresses from dmesg and locate kernel code/data, potentially bypassing KASLR. The vulnerability is described for Linux kernels...

CVE-2020-36782

CVE-2020-36782 covers a Linux kernel vulnerability in the I2C imx-lpi2c driver where the PM reference count could leak due to an unbalanced increment on return from pm_runtime_get_sync failures. The root cause is that pm_runtime_get_sync increments the PM usage count even when the operation fails...

CVE-2021-47430

CVE-2021-47430 concerns a Linux kernel issue related to SMAP handling on x86. The vulnerability arises in x86/entry where the OS may warn when AC is active in user mode, even if SMAP is disabled or partially disabled, leading to a conditional warning that could fire on machines that support SMAP ...

CVE-2021-47541

CVE-2021-47541 targets the Linux kernel mlx4_en driver. In mlx4_en_try_alloc_resources(), mlx4_en_copy_priv() may free tmp->tx_cq on the error path, and later mlx4_en_alloc_resources() dereferences &tmp->tx_cq[t][i], risking a use-after-free. The fix adds a guard/check around mlx4_en_copy_p...

CVE-2021-47552

CVE-2021-47552 affects the Linux kernel’s block multi-queue (blk-mq) I/O scheduling. The root issue was a race where scsi_device could be freed before blk_release_queue() ran, leading to a kernel oops. The fix cancels blk-mq dispatch work in both blk_cleanup_queue() and disk_release(), ensuring I...

CVE-2021-47563

In the Linux kernel, the following vulnerability has been resolved: ice: avoid bpf_prog refcount underflow Ice driver has the routines for managing XDP resources that are sharedbetween ndo_bpf op and VSI rebuild flow. The latter takes place forexample when user changes queue count on an interface...

CVE-2021-47571

The CVE-2021-47571 issue affects the Linux kernel rtl8192e driver in staging. The root cause is a use-after-free in _rtl92e_pci_disconnect() where free_rtllib() frees the dev pointer, and the code reorders operations to avoid using the freed pointer. The vulnerability leads to potential use-after...

CVE-2022-48858

CVE-2022-48858 - Linux kernel mlx5 race (net/mlx5): The vulnerability results from a race on command flush, causing a refcount use-after-free when a command is freed while another process may still access it. The root cause is improper synchronization around command entry refcount, leading to a p...

CVE-2022-48868

The CVE-2022-48868 issue affects the Linux kernel’s dmaengine: idxd driver. The root cause is in the probe/enabling path: drv_enable_wq() may return success on failure to enable the workqueue, allowing the driver to load while allocations intended for the workqueue enablement were never valid, wh...

CVE-2022-48958

The CVE-2022-48958 issue is in the Linux kernel ethernet aeroflex driver (greth_init_rings). The root cause is a skb leak when dma_mapping_error() occurs, where the newly allocated skb was not freed. A fix adds dev_kfree_skb() to ensure proper cleanup. The vulnerability is addressed by kernel pat...

CVE-2022-48966

The CVE-2022-48966 entry concerns the Linux kernel net/mvneta: out-of-bounds read in mvneta_config_rss(). The user-supplied pp->indir[0] is used in cpu_online(pp->rxq_def) inside mvneta_percpu_elect(), so the issue is a bounds-checking flaw on the cpu bitmap. A fix has been applied in the k...

CVE-2022-48971

CVE-2022-48971 describes a Linux kernel Bluetooth initialization issue: if bt_init fails after registering an LED via bt_leds_init(), bt_leds_cleanup() may not run, potentially allowing a freed bluetooth-power text to be accessed by later led_trigger_register() calls. The result can be a kernel p...

CVE-2022-48979

CVE-2022-48979 affects the Linux kernel driver path drm/amd/display/dc/dml (DCN32 DML). The root cause is an array indexing error where LinkCapacitySupport is indexed by the number of voltage states instead of the maximum DPPs, leading to an out-of-bounds access. The fix is to declare the array w...

CVE-2022-48987

CVE-2022-48987 affects the Linux kernel in media: v4l2-dv-timings.c. The issue was a misapplied blanking sanity check: when userspace supplies only a total blanking value, the total could be assigned to front porch, backporch, or sync fields, causing an overflow check to fail. The fix adds maximu...

CVE-2022-49335

CVE-2022-49335 concerns the Linux kernel DRM/AMDGPU path. The issue arises when a compute submit command (cs) is sent with 0 chunks, which is illegal and leads to a kernel oops later, specifically a NULL pointer dereference in amdgpu_cs_ioctl. Affected evidence shows a crafted 0-chunk submission ...

CVE-2022-49381

CVE-2022-49381 (Linux kernel, jffs2) The issue arises from a memory leak in jffs2_sum_init() when jffs2_iget() or d_make_root() in jffs2_do_fill_super() return an error; allocated resources are not released, leading to kmemleak reports. The provided connected descriptions explain that the leak is...

CVE-2022-49462

The CVE-2022-49462 issue affects the Linux kernel DRM MSM A6xx driver (a6xx_gpu_init). Root cause: of_parse_phandle() returns a node pointer with refcount incremented and a missing of_node_put() leads to a refcount leak. The code path in a6xx_gmu_init() passes the node to of_find_device_by_node()...

CVE-2022-49501

The Linux kernel contains a vulnerability in the usbnet driver where unregister_netdev() was incorrectly called before unbind(). This was intended to address a use-after-free issue during the disconnection of USB Ethernet adapters , but the implementation created an asymmetry with the binding pro...

CVE-2022-49648

CVE-2022-49648 – Linux kernel tracing/histograms memory leak fix . The provided documents confirm a memory-leak regression in the tracing/histograms area that occurred after a double-free fix, and that the issue was resolved by reverting the commit described as fixing double free. The description...

CVE-2022-49694

The Linux kernel contains a use-after-free vulnerability in the del_gendisk function. The issue occurs because disabling the elevator and freeing the scheduler tags were being performed in disk_release and blk_cleanup_queue, where the q->tag_set might already be dead. To resolve this, the work...

CVE-2022-49729

CVE-2022-49729 affects the Linux kernel’s nfcmrvl NFC driver. The issue is a memory leak in nfcmrvl_play_deferred caused by submitting deferred URBs directly via usb_submit_urb and then unanchoring them, which could prevent proper unref and leak memory. The fix, as described in connected advisori...

CVE-2022-49850

CVE-2022-49850 affects the Linux kernel nilfs2 subsystem. A semaphore deadlock can occur when nilfs_get_block() detects metadata corruption during data-block allocation and a concurrent superblock writeback happens. The root cause involves a lock order: rwsem A (NILFS_MDT dat_inode mi_sem) read l...

CVE-2023-2898

CVE-2023-2898 is a Linux kernel vulnerability: a null-pointer dereference in f2fs_write_end_io (fs/f2fs/data.c) can be triggered by a local, privileged user to cause a denial of service. Public documentation confirms this flaw and ties it to the f2fs filesystem on the Linux kernel, with advisorie...

CVE-2023-38428

CVE-2023-38428 affects the Linux kernel (ksmbd) where fs/ksmbd/smb2pdu.c does not properly validate the UserName value because it ignores the address of the security buffer, causing an out-of-bounds read. The public description confirms the issue exists in kernels before 6.3.4. The connected docs...

CVE-2023-52694

CVE-2023-52694 relates to the Linux kernel drm/bridge tpd12s015 driver. The issue arises from marking tpd12s015_remove() with __exit, which causes the function to be discarded when the driver is built-in; on unbind, cleanup may be skipped, leading to resource leakage. The vulnerability was resolv...

CVE-2023-52754

CVE-2023-52754 is a Linux kernel vulnerability in the imon USB driver. The driver could memory-corrupt by naively assuming the first interface is bound to imon when probing the second interface; a malformed descriptor could bind the first interface to another driver. A patch adds a sanity check a...

CVE-2023-52755

CVE-2023-52755 involves a slab out-of-bounds write in ksmbd smb_inherit_dacl() in the Linux kernel. The root cause is an offsets check failure when offsets exceed allocation size; the fix adds validation of three offsets against allocation size. Public advisories (e.g., Astra Linux bulletin for L...

CVE-2023-52805

CVE-2023-52805 affects the Linux kernel/JFS inode allocation. The issue is an array-index-out-of-bounds in diAlloc caused by lack of validation of the iag’s agno during new inode allocation, which could lead to fragmentation. A fix was added to perform the necessary check, and multiple connected ...

CVE-2023-52861

In the Linux kernel, the following vulnerability has been resolved: drm: bridge: it66121: Fix invalid connector dereference Fix the NULL pointer dereference when no monitor is connected, and thesound card is opened from userspace. Instead return an empty buffer (of zeroes) as the EDID information...

CVE-2023-53085

The CVE-2023-53085 issue affects the Linux kernel, specifically the drm/edid path. The root cause is a data leak: on EDID fetch errors that leave the transfer buffer unchanged, slab data can be leaked to logs. The fix clears the transfer buffer before fetching the EDID to prevent leaking informat...

CVE-2023-53098

CVE-2023-53098 summary (Linux kernel) : The vulnerability resides in the Media driver gpio-ir-recv under media: rc, where an added remove function plus runtime-pm cleanup is required. If runtime PM is enabled, systems must perform runtime PM cleanup to remove a cpu-latency QoS request; otherwise,...

CVE-2024-26652

In the Linux kernel, the following vulnerability has been resolved: net: pds_core: Fix possible double free in error handling path When auxiliary_device_add() returns error and then callsauxiliary_device_uninit(), Callback function pdsc_auxbus_dev_releasecalls kfree(padev) to free memory. We shou...

CVE-2024-26770

CVE-2024-26770 concerns the Linux kernel HID for the Nvidia Shield: a missing null-pointer check in LED initialization (led init path) could dereference NULL after devm_kasprintf() returns NULL. The issue arises during LED initialization within the Nvidia Shield HID handling; the CVSSv3.1 vector ...

CVE-2024-26854

In the Linux kernel, the following vulnerability has been resolved: ice: fix uninitialized dplls mutex usage The pf->dplls.lock mutex is initialized too late, after its first use.Move it to the top of ice_dpll_init.Note that the "err_exit" error path destroys the mutex. And the mutex isthe las...

CVE-2024-26918

CVE-2024-26918 : Linux kernel PCI PME polling fix. A previous patch required RPM_ACTIVE for PME polling, which was incorrect; only low-power states should be polled while still requiring device config space access. The fix formalizes the bridge/device PM usage and elevates the PM usage count to k...

CVE-2024-35785

CVE-2024-35785 affects the Linux kernel: a bug in the error path when registering devices on the TEE bus could trigger a kernel panic due to an incorrect error handling flow, specifically following the supplicant-based device enumeration change (commit 7269cba53d90). The issue manifests as a tran...

CVE-2024-35871

CVE-2024-35871 concerns a kernel-level issue in riscv process handling that leaks the kernel global pointer (gp) via user-space observables. The vulnerability stems from how childregs (the user-context registers during syscall) can expose kernel gp in several ways (e.g., after execve, via ptrace,...

CVE-2024-35993

Astra Linux bulletin confirms CVE-2024-35993 was resolved in the Linux kernel by turning folio_test_hugetlb into a PageType, addressing a race where concurrent folio splits could cause a false hugetlbfs classification. The vulnerability stemmed from folio_test_hugetlb() returning true for a folio...

CVE-2024-36909

CVE-2024-36909 : In the Linux kernel, Drivers: hv: vmbus: Don’t free ring buffers that couldn’t be re-encrypted. In CoCo VMs, an untrusted host can cause set_memory_encrypted()/set_memory_decrypted() to fail, leading to decrypted/shared memory being returned to the page allocator. The VMBus ring ...

CVE-2024-36912

The CVE-2024-36912 issue affects the Linux kernel hv: vmbus in Hyper-V guest mode. In CoCo VMs, an untrusted host could induce set_memory_encrypted() or set_memory_decrypted() to fail, causing decrypted/shared memory to be returned to the page allocator. The patch adds a field in struct vmbus_gpa...