CVE-2024-43825

The CVE-2024-43825 entry concerns a Linux kernel IIO subsystem issue: in iio_gts_build_avail_time_table, the sorting logic can misbehave when a time_us value is zero, potentially causing an out-of-bounds write (example sequence 3, 0, 1) and, if no zero times exist, elements may be copied unsorted...

CVE-2024-43850

CVE-2024-43850 affects the Linux kernel’s Qualcomm icc-bwmon: a refcount imbalance can occur during bwmon_remove, triggering a kernel warning and potentially delaying OPP releases. The OSV and vendor advisories corroborate the issue and describe the fix as a code correction in the bwmon removal p...

CVE-2024-43851

CVE-2024-43851 summary (Linux kernel) The issue affects Linux kernel code for the Xilinx SoC path (soc: xilinx). The root cause is the per-CPU variable cpu_number1 being passed to xlnx_event_handler as the argument dev_id, but not used by that function; a patch renames cpu_number1 to dummy_cpu_nu...

CVE-2024-43852

CVE-2024-43852 refers to a Linux kernel hwmon LTC2991 off-by-one bug in which LTC2991_T_INT_CH_NR is 4 and st->temp_en[] has 4 elements. The vulnerability occurs when channel equals LTC2991_T_INT_CH_NR, reading beyond the end of the array. The fix, described in the description, is to reorder t...

CVE-2024-43891

CVE-2024-43891 affects the Linux kernel tracing subsystem. The issue arises in eventfs dynamic event handling where the format file’s i_private pointed directly to the call entry, bypassing the file meta data, allowing a race with EVENT_FILE_FL_FREED. As a result, after the file is freed, reads/o...

CVE-2024-44967

CVE-2024-44967 affects the Linux kernel in the DRM mgag200 path. The issue arises from binding the lifetime of the I2C adapter to the DRM device: cleanup via devm_add_action_or_reset() releases the I2C adapter when the Linux device goes away, but the connector retains a stale pointer in struct dr...

CVE-2024-46718

CVE-2024-46718 affects the Linux kernel DRM/xe identity VRAM mapping. The issue is overmapping the identity VRAM mapping, which could trigger hardware bugs on certain platforms. The fix uses 2M pages for the last unaligned (to 1G) VRAM chunk, with v2/v3 updates tightening page usage and checks (2...

CVE-2024-46752

CVE-2024-46752 - Mode C (detailed, verified): The vulnerability is in the Linux kernel’s btrfs code path; specifically, update_ref_for_cow() previously used BUG_ON() and now returns an error, logs an error, and aborts the transaction when an extent buffer in the relocation tree lacks the full bac...

CVE-2024-50214

Technical details for CVE-2024-50214 are not public in the provided documents. Monitor for updates.

CVE-2024-50227

The CVE-2024-50227 entry concerns the Linux kernel Thunderbolt code, where KASAN reported a stack-out-of-bounds read in tb_retimer_scan(). The issue arises from a loop that increments a counter causing max to become 3 instead of 2, allowing the second loop to read past a stack array. The fix is t...

CVE-2024-55641

Technical details for CVE-2024-55641 (Linux kernel XFS inode unlock on error in xfs_trans_alloc_dir) are not present in the provided connected documents. Monitor for updates; the initial description notes the issue and patch, but no vendor/product/version specifics are provided here.

CVE-2024-56561

Technical details about CVE-2024-56561 are not provided in the connected documents. The initial description contains the kernel fix details but no public-facing specifics (affected products, versions, impact, or remediation) beyond that. Monitor for updates.

CVE-2024-56714

Technical details for CVE-2024-56714 are not publicly available in the provided documents. No explicit affected products, root cause, or remediation are listed here. Monitor for updates.

CVE-2024-57990

CVE-2024-57990 refers to a Linux kernel vulnerability in the wireless stack, specifically the MT7925 driver within the MT76/mt7925 code path. The root cause is an off-by-one error in the mt7925_load_clc() path that allowed an out-of-bounds read/write due to a comparison that used ‘>’ where ‘&g...

CVE-2025-21930

CVE-2025-21930 affects the Linux kernel wireless subsystem (iwlwifi/mvm). The vulnerability arises when the driver talks to firmware that may be dead; before sending a command it now checks that the firmware is alive, preventing commands on an unresponsive firmware. Impact: local attacker could c...

CVE-2025-22023

CVE-2025-22023 concerns the Linux kernel USB xHCI driver. The issue arises from not skipping missed isochronous TDs when handling Stopped/Stopped-Length-Invalid events, causing the ring to potentially stall and the affected TDs to be cancelled incorrectly. A patch (commit d56b0b2ab142) introduced...

CVE-2025-22047

Technical details for CVE-2025-22047 are not publicly provided in the supplied Connected documents. The materials reference the vulnerability fix in x86/ microcode AMD code but do not specify affected kernel versions, root cause analysis, exploit status, or remediation specifics. Monitor vendor a...

CVE-2025-22101

CVE-2025-22101 affects the Linux kernel net:libwx path, where a bug set the Tx L4 checksum flag for non-TCP/UDP/SCTP offloads, causing the TX ring to hang. The fix switches to software checksumming for these packets to avoid the hang. No exploitation details are provided in the documents. Remedia...

CVE-2025-23143

CVE-2025-23143 is a Linux kernel issue where unloading a module (e.g., CIFS/NFS) can race with a TCP socket still alive, leading to a NULL pointer dereference in lockdep when hlock_class() is called after the module is gone. The root cause is that CIFS assigns a different lock class to the socket...

CVE-2025-37761

CVE-2025-37761 affects the Linux kernel drm/xe TLB invalidation path. Root cause: an out-of-bounds shift when invalidating a TLB range larger than rounddown_pow_of_two(ULONG_MAX); fix uses a full TLB invalidation for such cases and updates the range size limit calculation. CVSSv3.1 vector: AV:L/A...

CVE-2025-37813

Technical details for CVE-2025-37813 are not publicly provided in the supplied documents. The connected advisories reference this CVE but do not disclose affected products, root cause, or fixes. Monitor vendor advisories for specifics.

CVE-2025-37828

CVE-2025-37828 affects the Linux kernel in the SCSI/UFS MCQ path. A race between MCQ completion and the abort handler can lead to dereferencing a NULL hwq pointer after __blk_mq_free_request() sets rq->mq_hctx to NULL. The fix adds a NULL check on the returned hwq in ufshcd_mcq_abort(); if hwq...

CVE-2025-37900

CVE-2025-37900: In the Linux kernel, two issues in iommu_copy_struct_from_user() were fixed in the current header; review noted NULL pointer handling in iommu_copy_struct_to_user() and a related typo. Connected advisories/entries confirm this CVE is included among kernel fixes across distribution...

CVE-2025-37945

CVE-2025-37945 — Linux kernel (net/phy, DSA) Affects MDIO bus PM ops for phylink-controlled PHYs. In drivers without MAC-managed PM, mdio_bus_phy_suspend() did not call phy_stop_machine() because phylink’s phydev->adjust_link is NULL, so the PHY state machine kept running. Consequently, mdio_b...

CVE-2025-37984

CVE-2025-37984 involves a Linux kernel crypto/ecdsa issue where DIV_ROUND_UP() could overflow with large ->key_size() values. The fix introduces a generic DIV_ROUND_UP_POW2() macro and applies it to ->key_size() return values, and also uses the macro in ecc_digits_from_bytes() where nbytes ...

CVE-2025-37993

CVE-2025-37993 refers to a Linux kernel issue where the m_can_classdev.tx_handling_spinlock was not initialized during device probe, causing a spinlock bad magic crash (notably when cansend is used). The problem is resolved by initializing the spin lock in m_can_class_allocate_dev. Affected conte...

CVE-2025-38084

CVE-2025-38084 affects the Linux kernel mm/hugetlb subsystem. Description: unshare of hugetlb page tables during VMA split occurs too early (before VMA/rmap locks), enabling racing page faults and rmap walks to share page tables before split. The fix: call hugetlb unshare logic from __split_vma()...

CVE-2025-38226

CVE-2025-38226 targets the Linux kernel, specifically the media/v4l2-tpg path used by vivid. The issue is a KASAN-detected vmalloc-out-of-bounds access in tpg_fill_plane_pattern and tpg_fill_plane_buffer (v4l2-tpg-core.c:2608 and 2705), causing a write of size 1440 to a kernel address during vivi...

CVE-2025-38279

CVE-2025-38279: Linux kernel bpf verifier backtracking bug in __mark_chain_precision (verifier) when handling precise registers; a test demonstrating a r10-related path and a patch that stops including stack ptr in precision backtracking was provided. Affected component: Linux kernel BPF verifier...

CVE-2025-38464

CVE-2025-38464 affects the Linux kernel Tipc subsystem. The issue is a use-after-free in tipc_conn_close() that can occur when tipc_topsrv_stop() iterates tipc_net(net)->topsrv->conn_idr and calls tipc_conn_close() for each tipc_conn after releasing the IDR lock. If tipc_conn_recv_work() is...

CVE-2026-31607

CVE-2026-31607 (Linux kernel USB/IP) : A RET_SUBMIT response can cause an out-of-bounds write when usbip_pack_ret_submit() overwrites urb->number_of_packets without validation. The loop bound in usbip_recv_iso()/usbip_pad_iso() then writes beyond urb->iso_frame_desc[], triggering a heap OOB...

CVE-2002-2438

CVE-2002-2438 describes a TCP/IP flaw where Linux TCP stack could bypass firewalls by receiving SYN packets that include additional flags (e.g., SYN+RST). The vulnerability arises because such packets were not consistently discarded by some stacks after firewalling, allowing a potential connectio...

CVE-2003-0985

CVE-2003-0985 affects Linux kernel 2.4.x (pre-2.4.21, possibly before 2.4.24). The do_mremap path lacks proper bounds checking, enabling local users to cause a denial of service and potentially gain privileges by remapping a VMA to a zero-length VMA. Connected data confirms CVE-2005-0528 is a dup...

CVE-2005-0736

CVE-2005-0736 entry is rejected/not used and does not represent an active vulnerability.

CVE-2008-3528

The CVE-2008-3528 entry concerns a DoS in the Linux kernel 2.6.26.5 lineages (fs/ext2/dir.c, fs/ext3/dir.c, and possibly fs/ext4/dir.c) where there is no limit on printk console messages reporting directory corruption. This enables physically proximate attackers to cause a temporary system hang b...

CVE-2008-4933

CVE-2008-4933: Buffer overflow in hfsplus_find_cat (fs/hfsplus/catalog.c) of the Linux kernel prior to 2.6.28-rc1. An invalid catalog namelength field in an hfsplus filesystem image can cause memory corruption and potentially a denial of service (memory corruption or system crash). Root cause cit...

CVE-2009-2849

CVE-2009-2849 affects the Linux kernel md driver (drivers/md/md.c) prior to version 2.6.30.2. The issue allows local attackers to trigger a NULL pointer dereference in suspend_lo_store and suspend_hi_store via writable sysfs suspend_* attributes, potentially causing a denial of service. The vulne...

CVE-2009-2908

CVE-2009-2908 affects the Linux kernel 2.6.31: the d_delete function in fs/ecryptfs/inode.c can lead to a negative dentry and a NULL pointer dereference. Local users can cause a kernel OOPS and potentially execute arbitrary code; exploitation demonstrated via a Mutt temporary directory in an eCry...

CVE-2009-3286

CVE-2009-3286 affects the Linux kernel 2.6.18 (and possibly other versions) where NFSv4 O_EXCL creates are not properly cleaned up, causing files to be created with insecure settings (e.g., setuid bits) and potentially enabling local privilege escalation. The issue is tied to the do_open_permissi...

CVE-2009-4131

The CVE refers to EXT4_IOC_MOVE_EXT (move extents) in the Linux kernel’s ext4 filesystem, where the ioctl allows local users to overwrite arbitrary files due to insufficient permission checks. Affected: ext4 subsystem on kernel versions prior to 2.6.32-git6. Impact: local privilege-related overwr...

CVE-2010-0007

CVE-2010-0007 affects the Linux kernel’s ebtables in netfilter, where netfilter/ebtables.c allows local users to modify rules without CAP_NET_ADMIN, bypassing access restrictions and enabling arbitrary network-traffic filtering via a modified ebtables user-space tool. Vulnerable: kernel before 2....

CVE-2010-4248

The CVE-2010-4248 issue affects the Linux kernel prior to 2.6.37-rc2. It is a race condition in the __exit_signal function (kernel/exit.c) that can be triggered by multithreaded exec paths, with related dynamics involving a thread group leader in kernel/posix-cpu-timers.c and the reassignment of ...

CVE-2011-2494

The CVE-2011-2494 issue affects the Linux kernel (taskstats.c) up to version before 3.1. Local users can obtain sensitive I/O statistics by sending taskstats commands to a netlink socket, with the description noting this could reveal password length information. The vulnerability’s root cause is ...

CVE-2012-6547

CVE-2012-6547 is the Linux kernel issue where __tun_chr_ioctl in drivers/net/tun.c may leave a structure uninitialized, enabling local users to read kernel stack memory. It is described as affecting Linux kernels prior to 3.6; MiracleLinux advisories list this CVE among others in kernel packages ...

CVE-2013-0160

CVE-2013-0160 affects the Linux kernel up to version 3.7.9. It enables local attackers to obtain sensitive keystroke timing information by abusing the inotify API on the /dev/ptmx device. The impact is described as partial confidentiality loss; no guidance on exploit details or mitigation is prov...

CVE-2013-1860

CVE-2013-1860 is a heap-based buffer overflow in the Linux kernel’s wdm_in_callback (drivers/usb/class/cdc-wdm.c) present in versions prior to 3.8.4. The vulnerability allows physically proximate attackers to crash the system or potentially execute arbitrary code through a crafted cdc-wdm USB dev...

CVE-2014-1690

The vulnerability CVE-2014-1690 affects the Linux kernel’s net/netfilter/nf_nat_irc.c before 3.12.8. An IRC DCC session with incorrect NAT mangle data can allow a remote attacker to read kernel memory. Impact is information disclosure; exploitation context is remote over the network. The fixed ve...

CVE-2014-9428

CVE-2014-9428 affects the Linux kernel’s B.A.T.M.A.N. fragmentation code (batadv_frag_merge_packets in net/batman-adv/fragmentation.c) up to version 3.18.1, where an incorrect length field in a memory calculation can be exploited by remote attackers to cause a denial of service (mesh-node system ...

CVE-2015-6526

CVE-2015-6526 affects the Linux kernel on ppc64 where perf_callchain_user_64 can enter an infinite loop due to a deep 64-bit userspace backtrace. The evidence points to Linux kernel versions before 4.0.2 (fixed in 4.0.2) and local DoS via a crafted backtrace. Affected component: arch/powerpc/perf...

CVE-2015-8967

From connected documents: CVE-2015-8967 affects the Linux kernel's arch/arm64/kernel/sys.c prior to version 4.0. Local users with write access can bypass the kernel’s strict page permissions and modify the system-call table to gain privileges, implying local privilege escalation. A patch/commit a...