CVE-2013-4163

CVE-2013-4163 affects the Linux kernel IPv6 path (ip6_output.c: ip6_append_data_mtu). The bug stems from not correctly tracking whether IPV6_MTU was set via setsockopt, enabling local attackers to crash the system by crafting a UDP_CORK-reliant application. Impact is local denial of service/OS cr...

CVE-2015-8746

CVE-2015-8746 affects the Linux kernel NFS client (fs/nfs/nfs4proc.c). The root cause is that memory is not properly initialized for migration recovery operations in the NFS client, which can be exploited by remote NFS servers to trigger a denial of service via a null pointer dereference and kern...

CVE-2017-18218

CVE-2017-18218 affects the Linux kernel's HNS Ethernet driver (drivers/net/ethernet/hisilicon/hns/hns_enet.c) pre-4.13. Local users can trigger a denial of service via use-after-free/BUG by exploiting differences in skb handling between hns_nic_net_xmit_hw and hns_nic_net_xmit. The connected docu...

CVE-2018-12929

CVE-2018-12929 concerns the Linux kernel ntfs_read_locked_inode vulnerability in ntfs.ko on kernel 4.15.0, which can trigger a use-after-free read and potentially cause a denial of service (kernel oops or panic) via a crafted NTFS filesystem. The available documents confirm the CVE ID and the aff...

CVE-2020-36789

The CVE-2020-36789 entry pertains to the Linux kernel CAN stack. A driver calling can_get_echo_skb() in hardware IRQ context could trigger WARN_ON(in_irq) in skb_release_head_state() under congestion, risking NULL pointer dereference. Root cause: kfree_skb() used instead of the IRQ-safe path in n...

CVE-2021-47086

The CVE-2021-47086 entry concerns the Linux kernel Phonet/pep path. The connected Astra Linux bulletin repeats that the vulnerability arises in an ioctl that refines enabling an unbound pipe, where the socket may not be bound to a valid Phonet object. If the socket is not bound, two issues occur:...

CVE-2021-47165

CVE-2021-47165 relates to the Linux kernel drm/meson shutdown crash when the main component is not probed (e.g., dw-hdmi not loaded or probe deferred). The issue causes a NULL dereference during shutdown, shown in meson_drv_shutdown and related shutdown paths. The fix described across sources is ...

CVE-2021-47362

CVE-2021-47362 affects the Linux kernel’s drm/amd/pm power management code. The vulnerability occurs during DPM initialization when set_power_state reads values from the current state; if current state is not populated, this can lead to a NULL pointer dereference. The ATCS/ACPI path for PCI speed...

CVE-2021-47401

In the provided documents, CVE-2021-47401 affects the Linux kernel’s ipack/ipoctal driver (drivers/ipack/devices/ipoctal.c). The root cause is that the tty driver name was allocated on the stack, enabling a stack information leak to user space or triggering an oops, and the name could encode topo...

CVE-2021-47453

CVE-2021-47453: In the Linux kernel, the ice driver could crash during unload if RDMA support is uninitialized, due to freeing aux_idx unconditionally in the remove path. The root cause is an IDA free that wasn’t gated by the RDMA status bit, which could be allocated at probe time but become unne...

CVE-2021-47518

CVE-2021-47518 summary (Linux kernel) : A NULL pointer dereference in the NFC (nfc) subsystem was fixed. The netlink callback nfc_genl_dump_ses_done() did not verify that its received argument is non-NULL, risking dereference if allocation failed earlier in dumpit() (nfc_genl_dump_ses()). A patch...

CVE-2021-47596

CVE-2021-47596 is a Linux kernel use-after-free in the hns3 driver (net: hns3: fix use-after-free bug in hclgevf_send_mbx_msg). The vulnerability arises from the removal sequence where the netdevice is freed during client removal, while the acceleration engine’s uninstall step still traces runtim...

CVE-2021-47653

The CVE-2021-47653 case concerns a Linux kernel media/davinci vpif driver use-after-free on driver unbind. The driver allocates two platform device structures during probe and fails to deregister them on unbind, risking freeing device resources at remove() time. The published fix adds the missing...

CVE-2022-48863

The CVE-2022-48863 entry describes a Linux kernel vulnerability in mISDN: dsp_pipeline_build() leaks memory due to dup pointer handling. Specifically, dsp_pipeline_build() allocates dup with kstrdup(cfg) and then updates dup via strsep(&dup, "|"), leaving dup as NULL when kfree(dup) is called. Th...

CVE-2022-48941

CVE-2022-48941 affects the Linux kernel ice driver handling of Virtual Functions (VFs). The issue arises from a concurrency gap between VF reset and VF removal. The patch that introduced ICE_VF_DEINIT_IN_PROGRESS aimed to prevent issues during teardown but inadvertently caused the PF to stop resp...

CVE-2022-49017

CVE-2022-49017 (Linux kernel) : A use-after-free in Tipc processing was mitigated by re-fetching the skb control block from the newly allocated skb after tipc_msg_validate(), preventing dereferencing a freed skb. The issue manifested as a KASAN use-after-free in tipc_crypto_rcv_complete and relat...

CVE-2022-49044

CVE-2022-49044 affects the Linux kernel dm‑integrity driver. When tag_size is smaller than the digest size, a portion of the digest is written beyond the end of ic->recalc_tags, corrupting memory in integrity_recalc->integrity_sector_checksum->crypto_shash_final. The fix increases the ta...

CVE-2022-49059

The CVE-2022-49059 issue is a Linux kernel vulnerability in NFC/NCI where a race between a delayed mechanism (timer) and a workqueue can lead to a use-after-free when detaching an NCI device. The fix added flush_workqueue to prevent this UAF by ensuring the timer/workqueue lifecycle cannot race w...

CVE-2022-49104

CVE-2022-49104 affects the Linux kernel, specifically the staging/vchiq_core code path. The issue is triggered when find_service_by_handle is given an invalid handle, which can return NULL and lead to a NULL pointer dereference. The description in the provided documents confirms this root cause a...

CVE-2022-49110

CVE-2022-49110 affects Linux kernel netfilter conntrack, where the gc autotuning change (as of commit 4608fdfc07e1) alters conntrack garbage collection frequency from every 2 minutes and changes eviction behavior. In large conntrack hash tables, evictions skew toward the GC path, risking netlink ...

CVE-2022-49178

CVE-2022-49178 affects the Linux kernel memstick driver (memstick/mspro_block). The issue relates to how read-only devices are handled in the mspro_block code path. Root cause: improper propagation of the read-only state through the block layer during open, leading to a potential reference leak w...

CVE-2022-49218

CVE-2022-49218 is a Linux kernel vulnerability in the DRM DP driver: an OOB read when handling the Post Cursor2 register due to an undersized link_status array. The fix removes the common helper and replaces the fetch/decode path with an open-coded approach, mirroring the handling in a related DR...

CVE-2022-49286

CVE-2022-49286 is tied to a Linux kernel TPM space fix: tpm2_del_space() was missing proper teardown after series conversion, leading to a tiny race where chip->tpm_mutex could be dereferenced if the space flush occurs after removal. The accepted mitigation is to convert tpm2_del_space() to us...

CVE-2022-49410

CVE-2022-49410: Linux kernel tracing double free in create_var_ref fixed by making init_var_ref() store NULL when freeing fields; affected components include the variable ref_field initialization path (create_hist_field -> init_var_ref -> destroy_hist_field). Remediation is to apply the ker...

CVE-2022-49523

CVE-2022-49523 affects the Linux kernel component ath11k, specifically the spectral scan path during spectral_deinit. The issue arises when ath11k modules are removed (rmmod) with spectral scan enabled, which can trigger a crash (kernel NULL pointer dereference) as shown by the provided call trac...

CVE-2022-49581

CVE-2022-49581 : In the Linux kernel, the be2net driver had a buffer overflow in be_get_module_eeprom due to improper handling of buffer length in be_cmd_read_port_transceiver_data. The vulnerable path could copy more data than available when the buffer is smaller than PAGE_DATA_LEN (or twice tha...

CVE-2022-49773

CVE-2022-49773 affects the Linux kernel (drm/amd/display for DCN314). Root cause: optc2_configure_crc() wraps optc1_configure_crc() plus extra registers not applicable to dcN314, which can trigger a warning trace. Mitigation/Fix: use optc1_configure_crc() directly. References note patches in kern...

CVE-2022-49790

CVE-2022-49790 concerns a Linux kernel vulnerability in the input driver for iforce. Syzbot reports an uninitialized value in iforce_init_device(), stemming from a length-check bug: the code in 6ac0aec6b0a6 allowed a read because it compared the requested read size against a valid length that cou...

CVE-2022-50200

The CVE-2022-50200 issue affects the Linux kernel and stems from missing boundary checks in the selinux put_entry() path. The vulnerability could allow memory out-of-bounds access (local attack) with high impact to confidentiality or availability as described in the advisory (vector: LOCAL, compl...

CVE-2023-3439

Ava ilable details from connected docs confirm CVE-2023-3439 affects the Linux kernel MCTP implementation. Specifically, mctp_unregister() reclaims a device resource on netcard detach, and a running routine may not notice this, leading to a use-after-free of the mdev->addrs object and a denial...

CVE-2023-52695

CVE-2023-52695 concerns the Linux kernel, specifically the DRM/AMD display path. The connected Nessus entry states the vulnerability was resolved by the patch: drm/amd/display: Check writeback connectors in create_validate_stream_for_sink. The stated root cause is to verify the connector type to ...

CVE-2023-52801

CVE-2023-52801 concerns the Linux kernel iommufd code. In iopt_area_split(), if the original iopt_area had filled a domain and is linked to domains_itree, pages_nodes must be reintegrated; otherwise domains_itree becomes corrupted and leads to use-after-free. The vulnerability is resolved by ensu...

CVE-2023-52861

In CVE-2023-52861, the Linux kernel DRM bridge it66121 had a NULL pointer dereference when no monitor is connected and the sound card is opened from userspace. The fix returns an empty EDID buffer (zeros) to the sound framework when no connector is attached, preventing the dereference and its pot...

CVE-2023-52879

The CVE-2023-52879 issue concerns the Linux kernel tracing subsystem, specifically the trace_event_file object used for tracefs events. A use-after-free can occur when a kprobe event is deleted while a user-space process still holds an opened “enable” file descriptor for that event, because the u...

CVE-2024-26750

CVE-2024-26750 affects the Linux kernel. The vulnerability was in af_unix garbage collection: a self-referencing oob_skb/FD scenario could cause __unix_gc() to hang due to a loop that fails to purge inflight sockets. The fix drops the oob_skb reference before purging the queue, allowing __skb_que...

CVE-2024-26797

CVE-2024-26797 affects the Linux kernel's AMDGPU display path (drm/amd/display). The issue was a potential buffer overflow in map_hw_resources where an index could exceed array bounds. A bounds check was added to ensure the index stays within array limits; if out of bounds, an error is logged and...

CVE-2024-26823

CVE-2024-26823 affects the Linux kernel IRQCHIP/GIC-V3-ITS, where ACPI-based quirk handling was lost during ITS probing. The bug could cause loss of GICv4 functionality or boot failures on affected systems (e.g., HIP07) unless booting with device tree. The fixed approach moves the enabling of qui...

CVE-2024-26860

CVE-2024-26860: In the Linux kernel, the dm‑integrity path leaked memory for the checksums pointer if the data was rechecked after a checksum failure (due to the goto skip_io path). The fix frees the checksums memory before rechecking and uses the checksum_onstack buffer for storing the checksum ...

CVE-2024-35804

CVE-2024-35804 affects the Linux kernel KVM/x86 emulation of atomic CMPXCHG. The root cause was that marking the guest page dirty during emulated atomic access could be dropped when converting the CMPXCHG to a user access, risking guest memory corruption during live migration. The fix ensures the...

CVE-2024-35833

CVE-2024-35833 affects the Linux kernel's dmaengine: fsl-qdma. The issue is a memory leak in the queue command DMA caused by dma_alloc_coherent() being undone in neither the remove path nor the error path of fsl_qdma_probe(). The advisory across connected sources states the fix is to switch to th...

CVE-2024-35850

CVE-2024-35850 affects the Linux kernel Bluetooth qca driver. Qualcomm ROME controllers registered from the Bluetooth line discipline can have a NULL HCI UART serdev pointer, leading to a NULL-pointer dereference when setup() is invoked for a non-serdev controller. The fix adds a missing sanity c...

CVE-2024-35871

CVE-2024-35871 concerns a kernel-level issue in riscv process handling that leaks the kernel global pointer (gp) via user-space observables. The vulnerability stems from how childregs (the user-context registers during syscall) can expose kernel gp in several ways (e.g., after execve, via ptrace,...

CVE-2024-36909

CVE-2024-36909 : In the Linux kernel, Drivers: hv: vmbus: Don’t free ring buffers that couldn’t be re-encrypted. In CoCo VMs, an untrusted host can cause set_memory_encrypted()/set_memory_decrypted() to fail, leading to decrypted/shared memory being returned to the page allocator. The VMBus ring ...

CVE-2024-36948

CVE-2024-36948 : In the Linux kernel, the drm/xe/xe_migrate code path cast to output precision before multiplying operands, addressing overflow when multiplying two 32-bit values before widening to 64-bit. Root cause: overflow in the result of multiplying two lower-precision (u32) operands prior ...

CVE-2024-38607

CVE-2024-38607 corresponds to a Linux kernel issue: the via-macii ADB driver called request_irq() after disabling hard interrupts, which was unnecessary because the VIA shift register interrupt was masked during VIA1 initialization. The vulnerability is tied to the macintosh/via-macii driver and ...

CVE-2024-42155

The CVE-2024-42155 issue affects the Linux kernel on s390 architectures, where the k ey material of protected- or secure-keys should not be visible to the caller. The vulnerability notes that all copies of protected- or secure-keys must be wiped from the stack even if an error occurs. CVSS data p...

CVE-2024-43850

CVE-2024-43850 affects the Linux kernel’s Qualcomm icc-bwmon: a refcount imbalance can occur during bwmon_remove, triggering a kernel warning and potentially delaying OPP releases. The OSV and vendor advisories corroborate the issue and describe the fix as a code correction in the bwmon removal p...

CVE-2024-44966

The CVE-2024-44966 entry concerns a Linux kernel issue in the binfmt_flat component. A RISC-V specific FLAT format variant allocated no space for the shared library pointer region, but code initializing that region was not disabled, causing corruption of sizeof(long) bytes before the DATA segment...

CVE-2024-44993

In CVE-2024-44993, the Linux kernel DRM v3d driver exposes an out-of-bounds read in v3d_csd_job_run() when UBSAN is enabled on Raspberry Pi 5. The UAPI supplies seven configuration registers, but the code reads an eighth element of a __u32 array, triggering a local read violation in v3d_csd_job_r...

CVE-2024-46718

CVE-2024-46718 affects the Linux kernel DRM/xe identity VRAM mapping. The issue is overmapping the identity VRAM mapping, which could trigger hardware bugs on certain platforms. The fix uses 2M pages for the last unaligned (to 1G) VRAM chunk, with v2/v3 updates tightening page usage and checks (2...