CVE-2025-38095

CVE-2025-38095 affects the Linux kernel dma-buf path. The issue arises from inserting a memory barrier before updating num_fences: smp_store_mb() currently inserts the barrier after the storing operation, which can reorder memory updates contrary to the original intent, potentially triggering a N...

CVE-2024-57997

The CVE-2024-57997 issue affects the Linux kernel wcn36xx Wi‑Fi driver where channel survey memory allocation used an incorrect size, leading to potential use of uninitialized values when there are no frames on the channel. The root cause is a size calculation error in wcn36xx channel survey allo...

CVE-2024-58018

The CVE-2024-58018 issue affects the Linux kernel’s GSP command queue path within the Nouveau nvkm/GSP code. The root cause is in r535_gsp_cmdq_push/r535_gsp_msgq_wait logic: when handling large RPCs, the code treats the available pages as (write pointer, buf_size) and exits the wait prematurely,...

CVE-2025-21873

CVE-2025-21873 affects the Linux kernel SCSI/UFS stack, specifically the bsg path. The issue occurs when an ARPMB (arpmb) command fails on devices that do not support ARPMB, leading to a crash due to copying user data in bsg_transport_sg_io_fn(). When ufs_bsg_exec_advanced_rpmb_req() returns an e...

CVE-2025-22047

Technical details for CVE-2025-22047 are not publicly provided in the supplied Connected documents. The materials reference the vulnerability fix in x86/ microcode AMD code but do not specify affected kernel versions, root cause analysis, exploit status, or remediation specifics. Monitor vendor a...

CVE-2025-37791

CVE-2025-37791 affects the Linux kernel, specifically the ethtool CMIS CDB update path in net/ethtool/cmis_cdb.c. The flaw arises when rpl is passed to ethtool_cmis_module_poll() as a pointer; the code uses the pointer size instead of the actual object size, which should be sizeof(*rpl) (1 byte)....

CVE-2025-37856

The CVE-2025-37856 entry pertains to the Linux kernel’s btrfs subsystem, where hardening of block_group::bg_list against list_del() races was applied. The vulnerability centered on potential race conditions between bg_list list_del_init() and operations like btrfs_mark_bg_unused() or btrfs_mark_b...

CVE-2025-37876

Summary (CVE-2025-37876) The Linux kernel netfs code creates /proc/fs/netfs unconditionally; when CONFIG_NETFS_SUPPORTS=y and CONFIG_PROC_FS is disabled, this can trigger a kernel crash. The connected documents indicate the root cause is in netfs_init(), where proc_mmkdir is invoked without guard...

CVE-2025-37961

The CVE-2025-37961 entry describes a Linux kernel issue in the IP virtual server (ip_vs) path. A use of an uninitialized saddr argument in do_output_route4 could affect routing decision, potentially impacting connectivity for tunneled paths. The root cause is reading saddr despite an input that s...

CVE-2025-38002

CVE-2025-38002 concerns the Linux kernel io_uring/fdinfo path. The fix acquires the ctx->uring_lock around io_uring_show_fdinfo() and wraps the whole process in a ->uring_lock_trylock, returning no output if the lock can’t be grabbed. This addresses a race when the ring is actively resized,...

CVE-2025-38009

CVE-2025-38009 : In the Linux kernel, the wifi driver mt76 initializes and cleans up TX NAPI on removal. A fix disables TX NAPI before deleting the NAPI instance in mt76_dma_cleanup() to prevent a warning observed after commit 9dd05df8403b. The issue arises when driving removal of mt7921e/mt76 dr...

CVE-2025-38094

CVE-2025-38094 (Linux kernel, macb deadlock) Fix for a possible deadlock in the macb driver under cadence when THALT is high and TGO remains high. The issue occurred in contexts with interrupts disabled, where jiffies were not updated and the loop wouldn’t exit, potentially locking a sama5d4 devi...

CVE-2025-38145

CVE-2025-38145 affects the Linux kernel in the ASPEED SoC driver (aspeed_lpc_enable_snoop). The vulnerability is due to not checking the return value of devm_kasprintf(), which can return NULL on memory allocation failure, leading to a NULL pointer dereference. The connected documentation confirm...

CVE-2025-38187

Root-cause: In Linux kernel DRM Nouveau, a use-after-free occurs when sending large RPC fragments because the RPC container is freed prematurely after being passed to r535_gsp_rpc_send(). Fix: allocate a temporary RPC container for the initial fragment and free the caller’s container only after a...

CVE-2025-38245

In the Linux kernel ATM subsystem, CVE-2025-38245 is due to releasing atm_dev_mutex before procfs/sysfs removal in atm_dev_deregister(), creating a race window where a device may still appear in procfs while the device list no longer contains it. This can trigger a splat warning during atm_dev_re...

CVE-2025-38286

CVE-2025-38286 affects the Linux kernel with a fault in pinctrl/at91: at91_gpio_probe() not validating the OF alias, allowing out-of-bounds access to gpio_chips when indexing with an invalid value. The bug, which could be exposed if BUG() is compiled out, is mitigated by a kernel fix/workaround d...

CVE-2025-38453

CVE-2025-38453 affects the Linux kernel io_uring/msg_ring path, where io_kiocb freeing could occur while a previously freed request is still in use. The connected docs specify a root cause: requests allocated and freed independently in msg_ring can race with RCUs, risking use-after-free. The reco...

CVE-2026-31405

CVE-2026-31405 : Linux kernel media/dvb-net vulnerability — OOB read in ULE extension header tables due to 255-element lookup arrays; bounds check added for htype to ensure out-of-range SNDU is discarded. This resolves a kernel-wide issue and is reflected in OSV advisories (e.g., Root: Debian 11/...

CVE-2026-31700

Summary (CVE-2026-31700): In the Linux kernel, a TOCTOU race in tpacket_snd() when PACKET_VNET_HDR is enabled allows a user-space race on vnet_hdr fields between validation and use, bypassing safety checks. The vulnerability affects the mmap’d TX ring buffer where vnet_hdr points into user-contro...

CVE-2006-1056

CVE-2006-1056 : A vulnerability in the Linux kernel (before 2.6.16.9) and FreeBSD on AMD64/7th–8th gen AMD processors causes FXSAVE/FXRSTOR to save/restore only certain x87 registers when an exception is pending. This can allow a local attacker to infer portions of the floating‑point state of oth...

CVE-2009-1265

The CVE-2009-1265 issue affects the Linux kernel up to 2.6.30-rc1, specifically a integer overflow in rose_sendmsg (sys/net/af_rose.c) that can cause leakage of memory (“garbage”) via a large length value over the network. Remote attackers could obtain sensitive information. Affected: Linux kerne...

CVE-2009-3238

CVE-2009-3238 affects the Linux kernel (pre-2.6.30) where get_random_int in drivers/char/random.c produced insufficiently random numbers, enabling prediction of return values and potentially defeating defenses based on randomness. Several OS advisories (e.g., RHSA-2009:1438, ELSA-2009-1106/1438, ...

CVE-2011-2183

CVE-2011-2183 targets the Linux kernel’s Kernel SamePage Merging (KSM) feature. When KSM is enabled, a race in scan_get_next_rmap_item in mm/ksm.c can allow a local user to trigger a NULL pointer dereference, potentially crashing the kernel or causing other unspecified impact. Affected: Linux ker...

CVE-2012-1146

The vulnerability CVE-2012-1146 affects the Linux kernel, specifically mem_cgroup_usage_unregister_event in mm/memcontrol.c, when running versions before 3.2.10. The issue arises from how multiple events attached to the same eventfd are handled, enabling a local attacker to trigger a NULL pointer...

CVE-2012-1583

CVE-2012-1583 : Affected software is the Linux kernel (net/ipv6/xfrm6_tunnel.c) with the xfrm6_tunnel module enabled. The issue is a double free in xfrm6_tunnel_rcv, allowing remote attackers to cause a denial of service (panic) via crafted IPv6 packets on kernels before 2.6.22. This vulnerabilit...

CVE-2013-2850

CVE-2013-2850: Heap-based buffer overflow in the Linux kernel’s iSCSI target subsystem (iscsi_add_notunderstood_response in drivers/target/iscsi/iscsi_target_parameters.c) affects kernel versions up to 3.9.4. The flaw can allow remote attackers to trigger memory corruption and OOPS, with potentia...

CVE-2013-4163

CVE-2013-4163 affects the Linux kernel IPv6 path (ip6_output.c: ip6_append_data_mtu). The bug stems from not correctly tracking whether IPV6_MTU was set via setsockopt, enabling local attackers to crash the system by crafting a UDP_CORK-reliant application. Impact is local denial of service/OS cr...

CVE-2014-9729

CVE-2014-9729 affects the Linux kernel’s UDF filesystem implementation (fs/udf/inode.c: udf_read_inode). The issue is the function’s failure to ensure data-structure size consistency, enabling a local attacker to crash the system via a crafted UDF image. The vulnerability exists in kernel version...

CVE-2015-2877

CVE-2015-2877 affects Kernel Samepage Merging (KSM) in Linux kernels 2.6.32–4.x. The write-timing side channel allows a guest OS user to defeat ASLR on other guest instances via Cross-VM ASL Introspection (CAIN). The entry notes that disabling deduplication mitigates the attack vector. No explici...

CVE-2016-4558

CVE-2016-4558 : The Linux kernel BPF subsystem before 4.5.5 mishandles reference counts, enabling a local attacker to trigger a denial-of-service via use-after-free, with possible other impact on systems with large memory (32 GB+ and 1 TB mentioned in the advisory). The Nessus/NVD documents confi...

CVE-2017-17853

CVE-2017-17853 affects the Linux kernel’s BPF verifier (kernel/bpf/verifier.c) up to version 4.14.8. Local users can trigger memory corruption and potentially other impact via incorrect BPF_RSH signed bounds calculations. The connected Nessus advisories for Unity Linux describe the same issue and...

CVE-2018-6559

CVE-2018-6559 affects the Linux kernel overlayfs in Ubuntu 18.04/18.10. The vulnerability arises when mapping directory contents permissions inside nested user namespaces; a local attacker could exploit this to reveal names of files they would not normally access, bypassing some access controls. ...

CVE-2019-18786

In CVE-2019-18786, the Linux kernel up to version 5.3.8 contains an uninitialized f->fmt.sdr.reserved in rcar_drif_g_fmt_sdr_cap (drivers/media/platform/rcar_drif.c), enabling an information disclosure (memory disclosure) vulnerability. Connected advisories (Unity Nessus plugins) restate that ...

CVE-2021-47054

The CVE-2021-47054 issue is a Linux kernel vulnerability in the bus/qcom subsystem where a reference count leak could occur if the loop using for_each_available_child_of_node() is broken. The fix ensures the child node is put before returning, correcting manual decrement paths for the child when ...

CVE-2021-47113

CVE-2021-47113 affects the Linux kernel's btrfs code. The issue occurs in btrfs_rename_exchange when inserting inode refs for both sides of a rename; if the second insert fails, the first ref becomes dangling, risking a corrupt filesystem. The fix aborts after the first successful inode ref inser...

CVE-2021-47235

CVE-2021-47235 affects the Linux kernel net/ethernet path: ec_bhf_remove() uses priv (netdev private data) after free_netdev() is called, enabling a use-after-free. The fixed sequence moves free_netdev() to occur after the PCI I/O unmaps (pci_iounmap) of priv, preventing access to freed memory. D...

CVE-2021-47280

CVE-2021-47280 is a Linux kernel vulnerability affecting drm_getunique() in the DRM subsystem. A time-of-check-to-time-of-use (TOCTOU) error occurs by reading file_priv->master before acquiring the device master mutex, allowing a master pointer to be used after the original object may have bee...

CVE-2021-47425

CVE-2021-47425: Linux kernel vulnerability in i2c via ACPI resource leak. acpi_i2c_find_adapter_by_handle() calls bus_find_device() which takes a reference on the adapter that is never released, causing a reference-count leak and potentially rendering the adapter unremovable. Connected advisories...

CVE-2021-47453

CVE-2021-47453: In the Linux kernel, the ice driver could crash during unload if RDMA support is uninitialized, due to freeing aux_idx unconditionally in the remove path. The root cause is an IDA free that wasn’t gated by the RDMA status bit, which could be allocated at probe time but become unne...

CVE-2021-47476

The Linux kernel contains a vulnerability in the comedi: ni_usb6501 driver. The driver uses endpoint-sized USB transfer buffers but fails to perform sufficient sanity checks on the sizes. This lack of validation can lead to zero-size-pointer dereferences or overflowed transfer buffers within the ...

CVE-2021-47518

CVE-2021-47518 summary (Linux kernel) : A NULL pointer dereference in the NFC (nfc) subsystem was fixed. The netlink callback nfc_genl_dump_ses_done() did not verify that its received argument is non-NULL, risking dereference if allocation failed earlier in dumpit() (nfc_genl_dump_ses()). A patch...

CVE-2021-47632

CVE-2021-47632 affects the Linux kernel on PowerPC where a spin_lock in change_page_attr() for set_memory caused spinlock recursion. The fix removes the read/modify/write sequence and the spin_lock(), and uses atomic handling of page-flag sets (_PAGE_KERNEL_RO/ROX/RW/RWX) by comparing flag sets t...

CVE-2021-47645

CVE-2021-47645 affects the Linux kernel media subsystem (staging: media: zoran). The root cause is a miscalculated buffer index in zoran_reap_stat_com when tmp_dcim=1, which can lead to a NULL pointer dereference. Patches were applied to correct the calculation and add a defensive check to preven...

CVE-2021-47653

A use-after-free vulnerability exists in the Linux kernel within the media: davinci: vpif driver. The issue occurs during the driver unbind operation because the driver allocates and registers two platform device structures during the probe phase but fails to deregister them during unbind. Since ...

CVE-2022-3977

CVE-2022-3977 is a use-after-free in the Linux kernel MCTP implementation. It occurs when a user performs a DROPTAG ioctl while a socket close happens, potentially crashing the system or allowing local privilege escalation. The issue is documented across multiple sources (NVD entry and OSV/GNU-fa...

CVE-2022-48704

CVE-2022-48704 affects the Linux kernel’s DRM/Radeon path. The vulnerability stems from a race/flush issue where the radeon lockup work queue may not be fully flushed before the system enters D3hot, potentially leading to a kernel Oops and a stall in GPU work processing. The described fix adds a ...

CVE-2022-48721

CVE-2022-48721 – Linux kernel net/smc wakeup handling after fallback Affected: Linux kernel with net/smc subsystem using SMC fallback to TCP. Issue: when switching from SMC to TCP, some socket waitqueue entries (e.g., eppoll_entries) remain in smc socket->wq. After fallback, only clcsocket-&gt...

CVE-2022-48950

CVE-2022-48950 affects the Linux kernel: perf_pending_task() UaF could run after the event is freed. The root cause involves two situations: (1) task_work already queued before destroying the event; (2) destroying the event queues task_work. The documented fix is to extend the perf_event lifetime...

CVE-2022-48961

CVE-2022-48961 is a Linux kernel vulnerability affecting the MDIO subsystem. The issue is an unbalanced fwnode reference count in mdio_device_release(), caused by a missing fwnode_handle_put() in normal paths after fwnode_handle_get() during of_mdiobus_register_device() binding. The leak manifest...

CVE-2022-49031

The CVE-2022-49031 issue affects Linux kernel iio: health: afe4403, where an OOB read occurs in afe4403_read_raw due to out-of-bounds access to afe4403_channel_leds when channels exceed the array. The fix moves the chan->address access before using it, preventing the out-of-bounds read. The ac...