CVE-2024-57990

CVE-2024-57990 refers to a Linux kernel vulnerability in the wireless stack, specifically the MT7925 driver within the MT76/mt7925 code path. The root cause is an off-by-one error in the mt7925_load_clc() path that allowed an out-of-bounds read/write due to a comparison that used ‘>’ where ‘&g...

CVE-2025-21849

CVE-2025-21849: Linux kernel drm/i915/gt had potential deadlocks due to spin_lock/unlock() used in interrupt contexts. The fix saves irq state before acquiring locks. Version history shows v2 adds irq state save/restore around signal_irq_work locks; v3 uses spin_lock_irqsave() in guc_lrc_desc_unp...

CVE-2025-22024

CVE-2025-22024 : Linux kernel nfsd has a vulnerability in managing listener transports. When no threads are active, a root user using nfsdctl can remove a listener from the old list and then start more threads, which may lead to a refcount bug (use-after-free) in svc_recv/nfsd. The fix changes th...

CVE-2025-22031

CVE-2025-22031 affects the Linux kernel PCI/bwctrl subsystem. Root cause: when bus numbers are exhausted during PCI device enumeration, subordinate becomes NULL, and the bandwidth controller dereferences it during probe. This leads to a NULL pointer dereference and silent erroring of bandwidth co...

CVE-2025-22112

CVE-2025-22112 affects the Linux kernel bnxt ethernet driver. The vulnerability arises from out-of-range access to the vnic_info array in bnxt_queue_start/stop where bp->nr_vnics is exceeded, allowing access to bp->vnic_info[bp->nr_vnics]. The issue is fixed in the publicly released comm...

CVE-2025-23154

CVE-2025-23154 concerns the Linux kernel’s io_uring path. The issue arises from io_req_post_cqe being used for non-multishot requests, enabling abuse via a send bundle in io_uring/net. The fix adds a flag to indicate whether a request will post multiple CQEs; multishot (REQ_F_APOLL_MULTISHOT) sem...

CVE-2025-23162

The CVE-2025-23162 issue affects the Linux kernel DRM/XE driver with SR-IOV VFs. A VF could trigger a GT reset and attempt to write to register 0x941c, which is inaccessible to VFs, leading to a fault path during reset handling. The available connected docs document the root cause and provide a r...

CVE-2025-37759

The CVE-2025-37759 issue affects the Linux kernel’s ublk driver. The root cause is that the change in the ublk_abort_queue path did not grab a request reference during recovery reissues, allowing a zc (zero-copy) request to be requeued and re-dispatched and potentially freed before io_uring could...

CVE-2025-37822

CVE-2025-37822 resolves a Linux kernel issue in the RISC‑V uprobes path. The root cause was a missing fence.i after constructing the XOL (execute out-of-line) buffer used to single-step replaced instructions, which could lead to execution of stale/broken instructions. The vulnerability was observ...

CVE-2025-37828

CVE-2025-37828 affects the Linux kernel in the SCSI/UFS MCQ path. A race between MCQ completion and the abort handler can lead to dereferencing a NULL hwq pointer after __blk_mq_free_request() sets rq->mq_hctx to NULL. The fix adds a NULL check on the returned hwq in ufshcd_mcq_abort(); if hwq...

CVE-2025-37929

CVE-2025-37929 affects the Linux kernel arm64 Spectre-BHB mitigation (

CVE-2025-37933

CVE-2025-37933 is a Linux kernel vulnerability affecting the octeon_ep driver. The issue occurs when the host loses heartbeat messages from the device and the driver’s device-specific stop function (ndo_stop) frees resources; if the driver is unloaded during this window, resources may be freed tw...

CVE-2025-37965

Concretely described CVE-2025-37965 affects the Linux kernel DRM/AMD display code. The root cause is GFP_KERNEL memory allocations in populate_dml_plane_cfg_from_plane_state(), which are unsafe in atomic contexts. The fix removes dynamic allocations by passing a pointer to scaler_data within the ...

CVE-2025-38052

CVE-2025-38052 concerns the Linux kernel where a slab-use-after-free in net/tipc/crypto.c during tipc_aead_encrypt_done can occur after the tipc_crypto tx is freed when a namespace is deleted. The issue arises when simd_aead_encrypt is interrupted and crypto_simd_usable() returns false, allowing ...

CVE-2025-38145

CVE-2025-38145 affects the Linux kernel in the ASPEED SoC driver (aspeed_lpc_enable_snoop). The vulnerability is due to not checking the return value of devm_kasprintf(), which can return NULL on memory allocation failure, leading to a NULL pointer dereference. The connected documentation confirm...

CVE-2025-38186

CVE-2025-38186 (Linux kernel, bnxt_en/RoCE driver) : The issue arises from a double invocation path where bnxt_ulp_stop() and bnxt_ulp_start() can be invoked in sequence after bnxt_ulp_restart(), causing the RoCE driver’s aux driver suspend() to run twice and potentially dereference a NULL pointe...

CVE-2025-38286

CVE-2025-38286 affects the Linux kernel with a fault in pinctrl/at91: at91_gpio_probe() not validating the OF alias, allowing out-of-bounds access to gpio_chips when indexing with an invalid value. The bug, which could be exposed if BUG() is compiled out, is mitigated by a kernel fix/workaround d...

CVE-2025-38449

CVE-2025-38449 affects the Linux kernel’s DRM/GEM subsystem. A GEM handle could be released while the GEM buffer object remains attached to a DRM framebuffer, causing the backing dma-buf to be released and a segmentation fault during subsequent mode-setting (notably with shadow planes during page...

CVE-2025-38485

CVE-2025-38485 affects the Linux kernel IIO FXLS8962AF accelerator driver. The flaw is a use-after-free in fxls8962af_fifo_flush where indio_dev->active_scan_mask is accessed while the device might exit buffer mode mid-interrupt, creating a race that can lead to a NULL pointer dereference. The...

CVE-2008-1375

CVE-2008-1375 describes a race condition in the Linux kernel’s directory notification subsystem (dnotify). It affects Linux kernel 2.6.x before 2.6.24.6, and 2.6.25 before 2.6.25.1. Successful exploitation could allow local users to cause a denial of service (OOPS) and possibly gain privileges vi...

CVE-2008-3275

The CVE-2008-3275 issue affects the Linux kernel before 2.6.25.15, where the real_lookup and __lookup_hash functions in fs/namei.c fail to prevent creating a child dentry for a deleted (S_DEAD) directory. This enables a local attacker to trigger a denial of service by repeatedly creating files wi...

CVE-2008-5079

CVE-2008-5079 affects the Linux kernel ATM subsystem, specifically net/atm/svc.c in 2.6.27.8 and earlier. A local attacker can cause a denial of service (kernel infinite loop) by performing two calls to svc_listen on the same socket and then reading a /proc/net/atm/*vc file, which relates to corr...

CVE-2010-3079

CVE-2010-3079 affects the Linux kernel up to version 2.6.35.4, specifically in kernel/trace/ftrace.c when debugfs is enabled. The issue arises from interaction between mutex possession and llseek, causing a NULL pointer dereference and outage of all ftrace-related files, leading to a local DoS. A...

CVE-2010-4082

CVE-2010-4082 affects the Linux kernel prior to 2.6.36-rc5, where viafb_ioctl_get_viafb_info in drivers/video/via/ioctl.c fails to initialize a structure member. This can allow local users to leak potentially sensitive information from kernel stack memory via a VIAFB_GET_INFO ioctl call. The issu...

CVE-2010-4250

CVE-2010-4250 concerns a memory leak in the inotify_init1 path of the Linux kernel’s inotify subsystem (fs/notify/inotify/inotify_user.c) prior to kernel 2.6.37. The issue is triggered by failed attempts to create files, allowing local users to exhaust memory and potentially cause a denial of ser...

CVE-2011-5327

The CVE-2011-5327 issue affects the Linux kernel prior to 3.1, where an off-by-one in the function drivers/target/loopback/tcm_loop.c: tcm_loop_make_naa_tpg() can cause memory corruption. This root cause is stated across the CVE entry and related advisories, with impact described as memory corrup...

CVE-2012-1146

The vulnerability CVE-2012-1146 affects the Linux kernel, specifically mem_cgroup_usage_unregister_event in mm/memcontrol.c, when running versions before 3.2.10. The issue arises from how multiple events attached to the same eventfd are handled, enabling a local attacker to trigger a NULL pointer...

CVE-2012-1583

CVE-2012-1583 : Affected software is the Linux kernel (net/ipv6/xfrm6_tunnel.c) with the xfrm6_tunnel module enabled. The issue is a double free in xfrm6_tunnel_rcv, allowing remote attackers to cause a denial of service (panic) via crafted IPv6 packets on kernels before 2.6.22. This vulnerabilit...

CVE-2014-0049

CVE-2014-0049 affects the Linux kernel up to version 3.13.5 via a buffer overflow in the complete_emulated_mmio path of arch/x86/kvm/x86.c. The flaw allows a guest OS user to trigger an invalid memory copy that can lead to arbitrary code execution on the host. The published fix is in Linux kernel...

CVE-2016-4951

CVE-2016-4951 refers to a vulnerability in the Linux kernel (tipc_nl_publ_dump in net/tipc/socket.c) present up to version 4.6. The function does not verify socket existence, allowing a local attacker to trigger a denial of service via a NULL pointer dereference that can crash the system, potenti...

CVE-2017-16996

The CVE-2017-16996 entry affects the Linux kernel (up to version 4.14.8) in kernel/bpf/verifier.c, where register truncation mishandling is the root cause. This allows local users to trigger memory corruption and potentially other impacts described as a denial of service. The vulnerability is res...

CVE-2017-17854

CVE-2017-17854 affects the Linux kernel's kernel/bpf/verifier.c, with the vulnerability existing in images up to kernel version 4.14.8. The issue arises from unrestricted integer values used in pointer arithmetic, enabling local users to trigger a denial of service (integer overflow and memory co...

CVE-2017-18202

The CVE-2017-18202 issue affects the Linux kernel prior to 4.14.4, where __oom_reap_task_mm in mm/oom_kill.c mishandles gather operations. This can enable a local attacker to cause a denial of service via a TLB entry leak or use-after-free, potentially with other unspecified impacts by triggering...

CVE-2021-47039

CVE-2021-47039 entry is rejected and not an active vulnerability entry.

CVE-2021-47111

CVE-2021-47111 affects the Linux kernel xen-netback where the RX task thread could be freed before kthread_stop during backend teardown, causing a use-after-free. The fix reintroduces taking a reference to the RX task thread and adds an explanation why it’s needed (XSA-374 / CVE-2021-28691). Affe...

CVE-2021-47136

CVE-2021-47136 : In the Linux kernel Mellanox mlx5 driver, the tc skb extension (TC_SKB_EXT) may be left uninitialized due to not zero-initializing new fields when the extension is allocated, causing UBSAN-invalid loads. The connected document specifies the vulnerable code path as mlx5e_rep_tc_up...

CVE-2021-47207

CVE-2021-47207 (Linux kernel) : A null pointer dereference in ALSA gus handling (snd_gf1_dma_next_block) could occur if the pointer block returned null. The issue is fixed by adding a null check before dereferencing the pointer. Impact per the entry: local attack vector, low privileges required, ...

CVE-2021-47231

CVE-2021-47231 describes a memory leak in the Linux kernel SocketCAN driver (mcba_usb). The issue arises in mcba_usb_start() where 20 usb_coherent buffers are allocated but not freed; callbacks resubmit the URB and disconnect handling doesn’t free or mark URB_FREE_BUFFER for coherent buffers. Thi...

CVE-2021-47401

In the provided documents, CVE-2021-47401 affects the Linux kernel’s ipack/ipoctal driver (drivers/ipack/devices/ipoctal.c). The root cause is that the tty driver name was allocated on the stack, enabling a stack information leak to user space or triggering an oops, and the name could encode topo...

CVE-2021-47430

CVE-2021-47430 concerns a Linux kernel issue related to SMAP handling on x86. The vulnerability arises in x86/entry where the OS may warn when AC is active in user mode, even if SMAP is disabled or partially disabled, leading to a conditional warning that could fire on machines that support SMAP ...

CVE-2021-47476

CVE-2021-47476 : In the Linux kernel, the comedi driver for ni_usb6501 exposed a NULL-dereference/overflow risk in command paths due to endpoint-sized USB transfer buffers without proper size checks. Exploitation could occur if a malicious device reports smaller max-packet sizes than expected, af...

CVE-2021-47493

CVE-2021-47493 affects the Linux kernel OCFS2 subsystem. The issue is a race between ocfs2_test_bg_bit_allocatable() and jbd2_journal_put_journal_head() that can release the journal_head from the buffer_head, when bg_bh->b_private is NULL, leading to a vmcore crash. The described impact in the...

CVE-2021-47555

Summary (supported by provided docs): In the Linux kernel, the VLAN real_dev refcnt underflow was fixed. The issue occurred when an error was injected before dev_hold(real_dev) in register_vlan_dev(), causing the real_dev refcount to underflow and triggering a warning and an endless wait-loop dur...

CVE-2021-47600

The CVE-2021-47600 entry concerns a Linux kernel vulnerability in the dm btree code where a use-after-free occurs during rebalance_children. The root cause is described as a use-after-free in the btree remove path, with the fix specified as moving dm_tm_unlock() after dm_tm_dec(). The vulnerabili...

CVE-2021-47641

CVE-2021-47641 (Linux kernel) affects the video fbdev Cirrus driver (cirrusfb) within the kernel’s fbdev subsystem. The issue arises in cirrusfb_check_pixclock when pixclock can be zero, causing a divide by zero that Syzkaller reported. The driver then rounds up pixclock to approximate maxclock, ...

CVE-2022-48634

Summary of CVE-2022-48634 (Linux kernel) : Affects the gma500/GPU path in the Linux kernel. The fault was that gma_crtc_page_flip() held the event_lock spinlock while calling crtc_funcs->mode_set_base(), which takes ww_mutex, creating a sleeping context in an invalid path. The unlock should oc...

CVE-2022-48744

In CVE-2022-48744, the Linux kernel net/mlx5e driver was made resilient to field-bound checking by avoiding a field-overflowing memcpy() across neighboring fields. The root cause involved copying MLX5E_XDP_MIN_INLINE bytes into a 2-byte inline_hdr.start, causing writes to adjacent data (vlan_tci,...

CVE-2022-48887

CVE-2022-48887 affects the Linux kernel DRM vmwgfx driver. User-resource lookups previously used RCU paths, which were buggy and could crash when command buffers were submitted from two threads. The fix replaces the RCU-based lookups with a regular spin lock to remove races in accesses to shared ...

CVE-2022-49065

The CVE-2022-49065 entry relates to the Linux kernel SUNRPC tracing: a NULL dereference crash when a sunrpc svc_rqst is deferred while tracing is enabled. The fix targets the trace class svc_deferred_event by avoiding reliance on a NULL dr->xprt and instead converting the remote address to a p...

CVE-2022-49102

CVE-2022-49102 affects the Linux kernel. The issue, resolved by a patch from habanalabs, fixes a memory leak in the MMU DR finalization path when the host-resident shadow is NULL, which can occur because the DR and HR are not dependent. The patch addresses a copy-paste error and prevents the leak...