CVE-2024-35785

CVE-2024-35785 affects the Linux kernel: a bug in the error path when registering devices on the TEE bus could trigger a kernel panic due to an incorrect error handling flow, specifically following the supplicant-based device enumeration change (commit 7269cba53d90). The issue manifests as a tran...

CVE-2024-35871

CVE-2024-35871 concerns a kernel-level issue in riscv process handling that leaks the kernel global pointer (gp) via user-space observables. The vulnerability stems from how childregs (the user-context registers during syscall) can expose kernel gp in several ways (e.g., after execve, via ptrace,...

CVE-2024-35926

CVE-2024-35926 : In the Linux kernel, the crypto IA A group fixes an async_disable descriptor leak in the iaa_compress/decompress paths. The root cause was that disable_async paths did not free idxd descriptors, leaking resources in tests where req->dst is null. A patch adds a proper free, res...

CVE-2024-35993

Astra Linux bulletin confirms CVE-2024-35993 was resolved in the Linux kernel by turning folio_test_hugetlb into a PageType, addressing a race where concurrent folio splits could cause a false hugetlbfs classification. The vulnerability stemmed from folio_test_hugetlb() returning true for a folio...

CVE-2024-36909

CVE-2024-36909 : In the Linux kernel, Drivers: hv: vmbus: Don’t free ring buffers that couldn’t be re-encrypted. In CoCo VMs, an untrusted host can cause set_memory_encrypted()/set_memory_decrypted() to fail, leading to decrypted/shared memory being returned to the page allocator. The VMBus ring ...

CVE-2024-36912

The CVE-2024-36912 issue affects the Linux kernel hv: vmbus in Hyper-V guest mode. In CoCo VMs, an untrusted host could induce set_memory_encrypted() or set_memory_decrypted() to fail, causing decrypted/shared memory to be returned to the page allocator. The patch adds a field in struct vmbus_gpa...

CVE-2024-36947

In CVE-2024-36947, the Linux kernel had a dentry leak in qibfs due to simple_recursive_removal() dropping pinning references for positives in a subtree. When the argument is retained by pinning from dcache lookup, it must be balanced with an explicit dput(); otherwise, a leak can occur. The conne...

CVE-2024-36949

CVE-2024-36949 affects the Linux kernel component responsible for AMD GPU kernel fusion driver (amd/amdkfd). The issue arises when multiple devices are reset in parallel: the first device calls kfd_suspend_all_processes() to evict all processes across devices, which can take time, while other dev...

CVE-2024-38603

Mode C CVE-2024-38603 (Linux kernel) affects drivers/perf: hisi: hns3. Root cause: pci_alloc_irq_vectors() allocates an irq vector; if devm_add_action() fails, the irq vector is not freed, causing a memory leak. Fix: replace devm_add_action() with devm_add_action_or_reset() so the irq vector can ...

CVE-2024-40985

CVE-2024-40985 concerns the Linux kernel TCP-AO subsystem. The issue is described as: in net/tcp_ao, ao_info could be leaked on error-path, introduced with TCP_AO_CMDF_AO_REQUIRED in patch set version 5. The vulnerability’s root cause is an information leak during error handling in the TCP-AO cod...

CVE-2024-42140

The CVE-2024-42140 issue affects the Linux kernel following kexec crash handling on riscv. The root cause is a deadlock when kexec crash code runs in interrupt context, caused by acquiring the irqdesc spinlock and deactivating irqchip in irq_set_irqchip_state(). The fix removes the unnecessary ir...

CVE-2024-42303

The CVE-2024-42303 issue affects the Linux kernel media imx-pxp driver. The root cause is an ERR_PTR dereference in pxp_probe() when devm_regmap_init_mmio() can fail, due to a missing check and bail‑out path. The patch adds a null/error check and exits gracefully, preventing a dereference and pot...

CVE-2024-43897

The CVE-2024-43897 entry concerns the Linux kernel net/virtio_net_hdr handling for GSO. The fix tightens csum_start and csum_offset checks in virtio_net_hdr_to_skb for GSO packets, ensuring that a checksum requested via VIRTIO_NET_HDR_F_NEEDS_CSUM is valid in the skb after segmentation. The patch...

CVE-2024-47717

Technical details for CVE-2024-47717 are not publicly provided in the supplied documents; monitor for updates.

CVE-2024-49876

CVE-2024-49876 affects the Linux kernel DRM-Xe path. The issue is a use-after-free (UAF) around queue destruction where final destruction steps could run on a workqueue that outlives the driver instance, risking references to freed objects. The fix adds a fini step to ensure user queues are torn ...

CVE-2024-50071

CVE-2024-50071 details (Linux kernel): The pinctrl nuvoton driver for MA35 pinsctrl contains a double-free bug in ma35_pinctrl_dt_node_to_map_func(). The issue arises because a buffer ('new_map') allocated with devm_kcalloc() is freed twice: once by the device framework on removal and again by pi...

CVE-2024-52319

CVE-2024-52319 — Linux kernel memory corruption/ information disclosure risk due to mm: use aligned address in clear_gigantic_page(). In current kernel, hugetlb_no_page() may call clear_gigantic_page() with a fault address that is not aligned to the huge page size, leading to potential memory cor...

CVE-2024-56536

Technical details (affected kernel version, exploit vectors, impact, and fixes) are not provided in the connected documents. Monitor for vendor advisories (kernel patches and CVE status) as no public exploit details are present in the supplied sources.

CVE-2024-56552

In Linux kernel DRM/XE GuC submission path, CVE-2024-56552 stems from a race between suspend_pending, disable_scheduling, and queue destruction. When suspending a queue and then closing it, the close path can signal suspendFence after the disable_scheduling response, which may clear suspend_pendi...

CVE-2024-57998

The CVE-2024-57998 issue affects the Linux kernel OPP (Operating Performance Points) subsystem. The vulnerability arises from a lack of proper index validation when reading the opp->rates[] table in _read_freq(), which could lead to a buffered read overflow. The patch adds an index parameter t...

CVE-2025-21886

CVE-2025-21886 summary (Linux kernel) This vulnerability affects the mlx5 RDMA path. The issue is related to implicit MR management during deregistration: on entering destroy_unused_implicit_child_mr(), the parent implicit MR’s refcount is incremented with refcount_inc_not_zero(), but a correspon...

CVE-2025-22092

The CVE-2025-22092 issue affects the Linux kernel PCI/SR-IOV path. Root cause: NULL dereference when handling virtfn creation error paths and during device removal, caused by an error handling flow after pci_setup_device() fails. The fix adds pci_iov_scan_device() to manage virtfn allocation/setu...

CVE-2025-22096

CVE-2025-22096 is a Linux kernel vulnerability resolved in the drm/msm/gem path. The root cause was in error handling: the SUBMIT_ERROR() macro made an error code negative, and an extra “-” turned it back to a positive EINVAL. The positive value was passed to ERR_PTR(), which is not an IS_ERR(), ...

CVE-2025-23154

CVE-2025-23154 concerns the Linux kernel’s io_uring path. The issue arises from io_req_post_cqe being used for non-multishot requests, enabling abuse via a send bundle in io_uring/net. The fix adds a flag to indicate whether a request will post multiple CQEs; multishot (REQ_F_APOLL_MULTISHOT) sem...

CVE-2025-37784

CVE-2025-37784 affects the Linux kernel ICSS IEP driver (net: ti: icss-iep). The vulnerability was caused by a NULL pointer dereference when disabling PPS/PEROUT during icss_iep_exit(), due to lingering perout state referenced by icss_iep_perout_enable_hw. The fix updates icss_iep_perout_enable_h...

CVE-2025-37791

CVE-2025-37791 affects the Linux kernel, specifically the ethtool CMIS CDB update path in net/ethtool/cmis_cdb.c. The flaw arises when rpl is passed to ethtool_cmis_module_poll() as a pointer; the code uses the pointer size instead of the actual object size, which should be sizeof(*rpl) (1 byte)....

CVE-2025-37809

CVE-2025-37809 : In the Linux kernel, the usb: typec: class path fixes a NULL pointer dereference that can occur when concurrent calls to typec_partner_unlink_device race with pointer usage. The patch adds a mutex to protect USB device pointers and the partner device registration, preventing NULL...

CVE-2025-37912

CVE-2025-37912 affects the Linux kernel ICE driver. The root cause is a missing null pointer check on the value returned by ice_get_vf_vsi(), which could lead to using a NULL VSI pointer in ice_vc_add_fdir_fltr(). The fix, described in commit baeb705fd6a7 ("ice: always check VF VSI pointer values...

CVE-2025-37933

CVE-2025-37933 is a Linux kernel vulnerability affecting the octeon_ep driver. The issue occurs when the host loses heartbeat messages from the device and the driver’s device-specific stop function (ndo_stop) frees resources; if the driver is unloaded during this window, resources may be freed tw...

CVE-2025-37946

CVE-2025-37946 concerns the Linux kernel, specifically the s390 PCI subsystem. The issue arises from a duplicate pci_dev_put() in disable_slot() when a PF has child VFs, introduced during a change that added a lock to zpci_dev state. The extra pci_dev_put() can lead to a use-after-free if the pci...

CVE-2025-37987

The CVE-2025-37987 entry refers to a Linux kernel vulnerability in pds_core: adminq overflow/stuck condition. The issue arises because the FW-backed adminq queue can become blocked when multiple adminq commands are posted, as completions occur in a different context. The advisory states the fix r...

CVE-2025-38161

The CVE-2025-38161 issue affects the Linux kernel’s RDMA mlx5 driver, where on RQ destruction a firmware command failure could have already cleaned some software resources, leaving the object in an inconsistent state. The fix adds proper rollback to the original state when destruction fails, and ...

CVE-2025-38220

CVE-2025-38220 affects the Linux kernel ext4 subsystem. The vulnerability occurs when processing an orphan-list symlink inode during truncation; partial block zeroing calls ext4_dirty_journalled_data() which invokes folio_mark_dirty() via mapping->a_ops->dirty_folio(), but symlink inodes la...

CVE-2025-38375

CVE-2025-38375: In the Linux kernel, virtio-net could trigger an out-of-bounds read due to not validating the received length against the allocated size when reading buffers from the ring in xdp_linearize_page. The fix adds the missing length check. Affected entries in Debian/Amazon/RH advisories...

CVE-2025-38457

CVE-2025-38457 concerns a Linux kernel net/sched bug where grafting a qdisc to a non-existent parent class could cause a failure during qdisc initialization. The fix introduces early validation via qdisc_leaf so that attempting to attach to a non-class parent aborts before qdisc_create. Affected ...

CVE-2025-38556

The Connected documents confirm CVE-2025-38556 affects the Linux kernel HID core, where the s32ton() conversion could crash when invoked with 0 bits. The fix HardenS32ton() so that it returns a reasonable result instead of faulting on 0-bit input, aligning behavior with snto32(). This CVE entry i...

CVE-2026-23112

CVE-2026-23112 affects the Linux kernel nvmet-tcp implementation. The issue in nvmet_tcp_build_pdu_iovec allows walking past cmd->req.sg when a PDU length/offset exceeds sg_cnt, causing bogus sg->length/offset usage and leading to _copy_to_iter() GPF/KASAN. The fix adds guards for sg_idx, r...

CVE-2026-43414

CVE-2026-43414 affects the Linux kernel SCSI driver qla2xxx (fcport handling). The issue is a double-free of a Fibre Channel port object in qla24xx_els_dcmd_iocb() via qla2x00_els_dcmd_sp_free() after kref_put(), leading to potential memory corruption and system instability or DoS as described by...

CVE-2026-53212

The CVE-2026-53212 issue affects the Linux kernel nft_tunnel implementation within netfilter, where nft_tunnel_obj_destroy() used metadata_dst_free() to free a metadata_dst, bypassing dst_entry refcount accounting. This could leave in-flight packets that hold references (via dst_hold()) dangling,...

CVE-2007-2453

CVE-2007-2453 concerns the Linux kernel RNG. Affected: Linux kernel 2.6 before 2.6.20.13 and 2.6.21.x before 2.6.21.4. Root cause: the entropy pool was not properly seeded when no entropy source, and entropy was extracted using an incorrect cast, which might cause the RNG to produce identical val...

CVE-2008-5025

CVE-2008-5025: Linux kernel before 2.6.28-rc1 suffers a stack-based buffer overflow in hfs_cat_find_brec() within fs/hfs/catalog.c when processing an HFS image with an invalid catalog namelength, enabling memory corruption or a system crash and a DoS. The MiracleLinux advisory and related OpenVAS...

CVE-2010-3861

CVE-2010-3861 affects the Linux kernel up to version 2.6.36. The vulnerability arises in the ethtool_get_rxnfc function in net/core/ethtool.c, which fails to initialize a certain block of heap memory. This can allow a local user to obtain potentially sensitive information via an ETHTOOL_GRXCLSRLA...

CVE-2010-4077

CVE-2010-4077 affects the Linux kernel up to 2.6.36.1: the function ntty_ioctl_tiocgicount in drivers/char/nozomi.c fails to initialize a structure member, allowing local attackers to read potentially sensitive information from kernel stack memory via the TIOCGICOUNT ioctl. The connected advisori...

CVE-2010-4078

CVE-2010-4078 affects the Linux kernel before 2.6.36-rc6, where the sisfb_ioctl function in drivers/video/sis/sis_main.c fails to properly initialize a structure member. This allows local users to leak potentially sensitive information from kernel stack memory via the FBIOGET_VBLANK ioctl. Connec...

CVE-2010-4169

CVE-2010-4169 is a Linux kernel use-after-free in mm/mprotect.c, vulnerable before 2.6.37-rc2. Local users can trigger a denial of service via an mprotect syscall. The MiracleLinux advisory AXSA:2011-80:02 confirms the issue among kernel fixes; remediation is to upgrade to kernel 2.6.37-rc2 or ne...

CVE-2011-1478

CVE-2011-1478 affects the Linux kernel’s GRO napi_reuse_skb path: it does not reset certain structure members in net/core/dev.c, enabling a remote attacker to trigger a NULL pointer dereference via a malformed VLAN frame and cause a denial of service. The vulnerability is present in kernels befor...

CVE-2013-1819

CVE-2013-1819 affects the Linux kernel prior to 3.7.6. The vulnerability resides in fs/xfs/xfs_buf.c: _xfs_buf_find does not validate block numbers, which can allow local users to mount an XFS filesystem with an invalid extent map and trigger a NULL pointer dereference, causing a denial of servic...

CVE-2013-3222

CVE-2013-3222 affects the Linux kernel: the vcc_recvmsg function in net/atm/common.c does not initialize a length variable, enabling a local attacker to read sensitive data from kernel stack memory via crafted recvmsg/recvfrom calls. The condition is “before 3.9-rc7”; the implication is a local i...

CVE-2013-4350

CVE-2013-4350 affects the Linux kernel IPv6 SCTP code (net/sctp/ipv6.c) up to version 3.11.1. The vulnerability arises because the data structures and function calls fail to trigger an intended IPsec encryption configuration, enabling remote attackers to sniff traffic and obtain sensitive informa...

CVE-2013-4483

The issue CVE-2013-4483 affects the Linux kernel (ipc/util.c: ipc_rcu_putref) where reference count handling is flawed in versions prior to 3.10. This local denial of service can be triggered by a crafted application, leading to memory consumption or system crash. Public advisories (e.g., Unity L...