CVE-2022-50015

CVE-2022-50015 : In the Linux kernel ASoC: SOF Intel hda-ipc, there is a vulnerability where a firmware could send a reply before the FW_READY message. Since reply_data is allocated after FW_READY, this can cause a NULL pointer dereference. The issue was reported for IPC4 and the same condition e...

CVE-2022-50044

CVE-2022-50044 stems from a race in the Linux kernel’s net: qrtr MHI channel handling. After enabling, an MHI event/interrupt can occur either before dev_set_drvdata is completed (causing qrtr-ns to fail service enumeration) or after dev_set_drvdata but before qrtr_endpoint_register (potential ke...

CVE-2023-0615

CVE-2023-0615 affects the Linux kernel V4L2 and vivid test code paths. The vulnerability is a memory leak with potential divide-by-zero and integer overflow when triggering ioctls such as VIDIOC_S_DV_TIMINGS, which could allow a local user to crash the system if vivid test code is enabled. Public...

CVE-2023-52519

CVE-2023-52519 — Linux kernel (intel-ish-hid) : On Elkhart Lake (EHL) based systems, an Out-of-Band wake service can enable PME wake. The ISH driver must re-enable the ACPI GPE bit on resume to preserve wake capability, but BIOS clears the bit without decrementing the OS GPE reference count, caus...

CVE-2023-52694

CVE-2023-52694 relates to the Linux kernel drm/bridge tpd12s015 driver. The issue arises from marking tpd12s015_remove() with __exit, which causes the function to be discarded when the driver is built-in; on unbind, cleanup may be skipped, leading to resource leakage. The vulnerability was resolv...

CVE-2023-52799

In Linux kernel, CVE-2023-52799 relates to an array-index-out-of-bounds in the JFS path during dmtree_t searches for free blocks (tp->dm_stree). The fix adds a parameter to dbFindLeaf to determine the dmtree type, enabling an out-of-bounds check and preventing access beyond array bounds. Affec...

CVE-2023-52816

CVE-2023-52816 relates to a Linux kernel flaw in drm/amdkfd where a UBSAN shift out-of-bounds occurs when shifting exponent 255, which is too large for a 64-bit unsigned long during a page-fault/get_user path. Impact is high (local exploitability per CVSS), and the issue is fixed by kernel patche...

CVE-2023-52851

The CVE-2023-52851 entry concerns the Linux kernel, specifically the mlx5/IB stack. Affected component: mlx5 mkey cache initialization and related UMR/IB registration cleanup paths in mlx5_ib_stage_post_ib_reg_umr_init, mlx5r_umr_resource_cleanup, and __mlx5_ib_add. Root cause: in mlx5_mkey_cache...

CVE-2023-52999

CVE-2023-52999 : In the Linux kernel, the UaF in netns ops registration error path is resolved by skipping the dereference of the gen pointer when net_assign_generic() fails, preventing a slab-out-of-bounds write. The change fixes ops_init/error path behavior after failure, addressing an out-of-b...

CVE-2024-26699

CVE-2024-26699 concerns the Linux kernel’s drm/amd/display code, specifically a fix for an array-index-out-of-bounds in dcn35_clkmgr. The root cause is a memory access violation when iterating through the dcn35 clocks array. The documented mitigation is to limit iteration to the array size. Concr...

CVE-2024-26902

CVE-2024-26902 concerns the Linux kernel: a RISCV perf PMU overflow panic when setting bits for overflowed_ctrs due to using (1 <

CVE-2024-26918

CVE-2024-26918 : Linux kernel PCI PME polling fix. A previous patch required RPM_ACTIVE for PME polling, which was incorrect; only low-power states should be polled while still requiring device config space access. The fix formalizes the bridge/device PM usage and elevates the PM usage count to k...

CVE-2024-35803

CVE-2024-35803 affects the Linux kernel, specifically the x86 efistub in mixed-mode boot handling. The root cause is that EFI boot service calls were made using the decompressor’s 16k boot stack during 32‑bit firmware entry paths, while EFI boot services require a larger (128k) stack. This mismat...

CVE-2024-35804

CVE-2024-35804 affects the Linux kernel KVM/x86 emulation of atomic CMPXCHG. The root cause was that marking the guest page dirty during emulated atomic access could be dropped when converting the CMPXCHG to a user access, risking guest memory corruption during live migration. The fix ensures the...

CVE-2024-35961

Summary: CVE-2024-35961 affects the Linux kernel mlx5 driver (net/mlx5). A non-fatal firmware error during device probe could cause a WARN_ON because devlink_register() was invoked late; the fix is to call devl_register() first under the devlink lock to avoid the warning. The issue is documented ...

CVE-2024-36937

Summary of CVE-2024-36937 : The Linux kernel vulnerability affects XDP redirect handling when broadcasting to a map via BPF_F_BROADCAST. The issue arose because xdp_do_redirect() could see a NULL destination pointer if the destination map was destroyed before the XDP program ran, causing a crash....

CVE-2024-36948

CVE-2024-36948 : In the Linux kernel, the drm/xe/xe_migrate code path cast to output precision before multiplying operands, addressing overflow when multiplying two 32-bit values before widening to 64-bit. Root cause: overflow in the result of multiplying two lower-precision (u32) operands prior ...

CVE-2024-40996

CVE-2024-40996 affects the Linux kernel. Problem: bpf: Avoid splat in pskb_pull_reason where a debug WARN may trigger for SYZKALLER-style nets; not interesting for valid traffic and can be suppressed. Root cause involves a debug hint in pskb_may_pull when CONFIG_DEBUG_NET=y; with CONFIG_DEBUG_NET...

CVE-2024-41149

CVE-2024-41149 concerns a Linux kernel use-after-free in the block layer where hctx must be removed from the cpuhp callback list before reuse. If hctx remains linked, reuse may trigger use-after-free, enabling local or partial system impact as described. A fix has been applied in the kernel; refe...

CVE-2024-42290

Affected software: Linux kernel irqchip/imx-irqsteer on platforms such as i.MX8QM and i.MX8QXP. Issue: power-domain handling via clk_prepare could trigger a scheduling-while-atomic bug during device probing due to non-atomic runtime PM context. Root cause: runtime power management not synchronize...

CVE-2024-46767

Technical details about CVE-2024-46767 are not provided in the connected documents. Monitor for updates.

CVE-2024-46831

The CVE-2024-46831 entry corresponds to a Linux kernel vulnerability in net: microchip: vcap where kunit tests trigger a use-after-free. The underlying issue is a use-after-free in kunit test code for vcap, which has been fixed by removing the problematic code and relying on checking the return v...

CVE-2024-50037

CVE-2024-50037 affects the Linux kernel’s DRM framebuffer path (drm/fbdev-dma). The root cause was that drm_fbdev_dma_fb_destroy() unconditionally invoked fb_deferred_io_cleanup() even when struct fb_info.fbdefio was NULL, leading to a warning trace in an Apple Silicon display driver context. The...

CVE-2024-50129

CVE-2024-50129 affects the Linux kernel in the net/pse-pd path, where an out-of-bounds access could occur when iterating PI structures. The fix tightens the loop limit so the code no longer accesses pcdev->nr_lines, which was allocated as exactly that many PI structures. This bounds-checking c...

CVE-2024-50213

CVE-2024-50213 pertains to the Linux kernel’s DRM HDMI test path. The issue is a memory leak where a mode object allocated by drm_mode_duplicate() during drm_display_mode_from_cea_vic() is not freed. This leak was observed when loading drm_hdmi_state_helper_test via modprobe and then removing it,...

CVE-2024-56542

Summary of CVE-2024-56542: In the Linux kernel, drm/amd/display suffers a memleak during driver removal (amdgpu) due to incomplete cleanup in the takedown path. The trace shows memory manager not clean during takedown and a cascade through amdgpu_gtt_mgr_fini, amdgpu_ttm_fini, amdgpu_bo_fini, gmc...

CVE-2024-57805

CVE-2024-57805: In the Linux kernel ASoC: SOF: Intel: hda-dai, the link DMA was released on STOP, enabling a potential stream mix-up if a new stream starts before the previous is fully closed. This may lead to firmware errors or a crash. Root cause: releasing the link DMA on STOP rather than wait...

CVE-2024-57978

CVE-2024-57978 refers to a Linux kernel vulnerability in the media: imx-jpeg driver. The issue arises in detach_pm() where, if jpeg->pd_dev[i] is an error pointer, passing it to pm_runtime_suspended() can trigger an Oops. The description notes that existing checks cover error pointers and NULL...

CVE-2025-22024

CVE-2025-22024 : Linux kernel nfsd has a vulnerability in managing listener transports. When no threads are active, a root user using nfsdctl can remove a listener from the old list and then start more threads, which may lead to a refcount bug (use-after-free) in svc_recv/nfsd. The fix changes th...

CVE-2025-22034

CVE-2025-22034 concerns the Linux kernel mm/gup path and the handling of FOLL_SPLIT_PMD with hugetlb VMAs. The connected documents indicate a patch series addressing device-exclusive entries (hmm) and that THP interaction was a motivating factor, with hugetlb fencing and mapcount interactions imp...

CVE-2025-37777

CVE-2025-37777: In the Linux kernel ksmbd path, a use-after-free could occur in __smb2_lease_break_noti() when the connection is disconnected, because ksmbd_conn_write may touch freed structures if conn->ksmbd_transport is already freed. The fix moves the tcp_transport free to ksmbd_conn_free,...

CVE-2025-37791

CVE-2025-37791 affects the Linux kernel, specifically the ethtool CMIS CDB update path in net/ethtool/cmis_cdb.c. The flaw arises when rpl is passed to ethtool_cmis_module_poll() as a pointer; the code uses the pointer size instead of the actual object size, which should be sizeof(*rpl) (1 byte)....

CVE-2025-37901

The CVE-2025-37901 issue affects the Linux kernel irqchip/qcom-mpm driver. On Qualcomm chipsets, some GPIOs are not wake-capable and lack a corresponding MPM pin; the IRQ domain hierarchy is still applied unless explicitly disconnected. This caused crashes when setting up interrupts for non-wake ...

CVE-2025-37918

CVE-2025-37918 affects the Azure Linux 3.0 kernel, specifically Bluetooth btusb handling of QCA firmware crash dumps on the WCN7851 (0489:e0f3). The issue is a NULL pointer dereference in skb_dequeue() caused by handle_dump_pkt_qca() returning 0 on success (and by forwarding the return value from...

CVE-2025-37922

CVE-2025-37922 concerns Linux kernel memory management: when section vmemmap start addresses are misaligned across namespaces, an altmap page may be reused by a different namespace, causing the previous namespace to free a page incorrectly and crash the kernel. The connected documents describe a ...

CVE-2025-37974

CVE-2025-37974: Linux kernel s390/pci vulnerability where zpci_create_device() may return an error pointer that is not checked before dereferencing it as a struct zpci_dev in __clp_add(); the fix adds a missing check so the device is not added to the scan_list, preventing the previous behavior. T...

CVE-2025-38068

CVE-2025-38068: In the Linux kernel, the crypto/lzo path fixed a compression buffer overrun by adding a safe compression interface that checks the end of the output buffer before each write and using it in crypto/lzo. This corrects a prior assumption that the caller always provided sufficient buf...

CVE-2025-38087

The CVE-2025-38087 entry refers to a Linux kernel vulnerability in net/sched: taprio_dev_notifier, where a race with advance_sched could cause a use-after-free because taprio_dev_notifier() was not protected by an RCU read-side critical section. The issue is resolved by adding an rcu_read_lock() ...

CVE-2025-38280

CVE-2025-38280 affects the Linux kernel’s BPF/JIT path. When a BPF program is compiled with JIT and CONFIG_BPF_JIT_ALWAYS_ON is not set while bpf_jit_enable is 1, the arch may attempt JIT the program, fail due to FAULT_INJECTION, and incorrectly treat the program as valid, causing a WARN_ON_ONCE ...

CVE-2025-38342

CVE-2025-38342 affects the Linux kernel; it stems from an out-of-bounds check in software_node_get_reference_args(), which may cause OOB access when reading the @index-th element due to a length check that can’t be guaranteed. The fix replaces the check with ((index + 1) * sizeof(*ref) > prop-...

CVE-2025-40364

CVE-2025-40364 : In the Linux kernel, the io_uring path titled “io_req_prep_async with provided buffers” has been resolved. The issue allowed io_req_prep_async() to import provided buffers and then commit the ring state by giving up on that path, with the buffers potentially being reimported late...

CVE-2026-46099

The CVE-2026-46099 entry describes a use-after-free race in Linux kernel IPv6 handling for seg6 and rpl lightweight tunnels. A NOREF destination cached during ip6_route_input() can be freed by a concurrent FIB lookup on a shared nexthop under PREEMPT_RT, leading to a WARN or potential instability...

CVE-2026-46113

CVE-2026-46113 (Linux kernel KVM x86 shadow paging use-after-free) is a resolved vulnerability in the KVM shadow paging path. The issue arises when the shadow MMU computes GFNs for direct shadow pages using sp->gfn plus the SPTE index and guest page-table modifications between VM entries can c...

CVE-2006-0039

CVE-2006-0039 is a race condition in the Linux kernel 2.6.16 netfilter do_add_counters that can allow a local user with CAP_NET_ADMIN to trigger a buffer over-read in IPT_ENTRY_ITERATE, enabling read of kernel memory. Public advisories (Ubuntu USN-311-1, Red Hat RHSA-2006:0689, Debian DSA-1097/11...

CVE-2007-5966

CVE-2007-5966 is a Linux kernel local privilege escalation: integer overflow in hrtimer_start (kernel/hrtimer.c) before 2.6.23.10 allows local users to run arbitrary code or cause a denial of service via a large relative timeout. Affected: Linux kernel versions prior to 2.6.23.10. Remediation: up...

CVE-2008-5134

CVE-2008-5134 involves a buffer overflow in the libertas wireless driver (lbs_process_bss in drivers/net/wireless/libertas/scan.c) in the Linux kernel up to versions before 2.6.27.5. The vulnerability can be triggered by an invalid beacon or probe response from a remote wireless network, with an ...

CVE-2009-4027

The CVE-2009-4027 issue is a race condition in Linux kernel mac80211 subsystem (pre-2.6.32-rc8-next-20091201) that enables a remote attacker to crash the system via a crafted DELBA frame, in the absence of an aggregation session. Connected documents confirm affected kernel versions and the Denial...

CVE-2010-0298

Summary: CVE-2010-0298 affects the x86 emulator in KVM 83, where CPL/IOPL checks are not applied to CPL3 memory accesses, enabling a guest OS user to crash the guest or gain privileges via an IO port or MMIO region (related to CVE-2010-0306). What is affected: KVM/x86 emulator code in affected Li...

CVE-2010-2537

CVE-2010-2537 affects the Linux kernel’s btrfs_ioctl_clone path: the btrfs_ioctl_clone function in fs/btrfs/ioctl.c before 2.6.35 allows a local attacker to overwrite an append‑only file when using BTRFS_IOC_CLONE or BTRFS_IOC_CLONE_RANGE with a donor file. Impact is local privilege/unauthorized ...

CVE-2011-2497

CVE-2011-2497 is a Linux kernel Bluetooth L2CAP underflow/overflow issue. The vulnerability arises from an integer underflow in l2cap_config_req in net/bluetooth/l2cap_core.c, enabling remote attackers to trigger a heap memory corruption or buffer overflow via a small command-size value in an L2C...