CVE-2024-26797

CVE-2024-26797 affects the Linux kernel's AMDGPU display path (drm/amd/display). The issue was a potential buffer overflow in map_hw_resources where an index could exceed array bounds. A bounds check was added to ensure the index stays within array limits; if out of bounds, an error is logged and...

CVE-2024-26823

CVE-2024-26823 affects the Linux kernel IRQCHIP/GIC-V3-ITS, where ACPI-based quirk handling was lost during ITS probing. The bug could cause loss of GICv4 functionality or boot failures on affected systems (e.g., HIP07) unless booting with device tree. The fixed approach moves the enabling of qui...

CVE-2024-26860

CVE-2024-26860: In the Linux kernel, the dm‑integrity path leaked memory for the checksums pointer if the data was rechecked after a checksum failure (due to the goto skip_io path). The fix frees the checksums memory before rechecking and uses the checksum_onstack buffer for storing the checksum ...

CVE-2024-35841

CVE-2024-35841 describes a Linux kernel vulnerability in the TLS path (net: tls) related to splice handling with MSG_SPLICE_PAGES. The issue occurs when moving user pages from msg to msg_pl; if more pages are added than MAX_MSG_FRAGS and the MORE flag is used, the code can attempt to re-fill a fu...

CVE-2024-35981

CVE-2024-35981 affects Linux kernel virtio_net RSS handling. Root cause: RSS command setup in virtionet may be sent even when the device does not support RSS, causing a zero-length buffer to be passed to QEMU and triggering a kernel loop due to virtqueue/broken device handling. Impact: potential ...

CVE-2024-35988

CVE-2024-35988 concerns the Linux kernel RISCV NOMMU patch that corrects TASK_SIZE for 64-bit NOMMU. The current TASK_SIZE definition caused spurious failures in userspace memory access when any RAM above 4 GiB existed, leading to incorrect memory access behavior. The vulnerability is resolved by...

CVE-2024-36890

CVE-2024-36890: Linux kernel mm/slab fix to have __free(kfree) treat error pointers as valid data. Previously, automatic cleanup could crash if an allocation freed as an error pointer was not checked; wm831x_gpio_dbg_show() is cited as an example. The resolution updates the auto cleanup path to v...

CVE-2024-36892

The CVE-2024-36892 issue affects the Linux kernel SLUB allocator. The fix addresses a bug in single-object free: when init_on_free=1, the freepointer inside the freed object could be zeroed (or its handling was unsafe) and, under slub_debug=F and CONFIG_SLAB_FREELIST_HARDENED, do_slab_free() coul...

CVE-2024-36895

The CVE-2024-36895 issue in the Linux kernel affects usb gadget uvc configfs parsing. A heap-allocated temp buffer used by __uvcg_iter_item_entries() was not constrained by a computed max size (previously size-checked via sizeof()), causing overly small max item sizes on some architectures (7 byt...

CVE-2024-36900

CVE-2024-36900 affects the Linux kernel’s net/hns3 driver. The vulnerability arises when a devlink reload occurs during hardware initialization: the reload can access hardware resources before initialization, potentially causing a kernel crash. The fix is to register devlink after hardware initia...

CVE-2024-36911

CVE-2024-36911 affects the Linux kernel hv_netvsc (Hyper-V host/guest networking). The root cause is that in CoCo VMs, a failure of set_memory_encrypted() or set_memory_decrypted() could cause memory to be shared and not properly freed. The netvsc driver could frees decrypted/shared pages if set_...

CVE-2024-39510

CVE-2024-39510 affects the Linux kernel’s cachefiles subsystem, specifically the cachefiles_ondemand_daemon_read path. The issue is a slab-use-after-free in cachefiles_ondemand_daemon_read() that can lead to use-after-free of an object during on-demand daemon restoration, as demonstrated by a KAS...

CVE-2024-46779

The CVE-2024-46779 item is a real Linux kernel issue where drm/imagination: Free pvr_vm_gpuva after unlink could leak memory in high-usage paths (remapping/unmapping device memory). The Connected Nessus entries (e.g., TencentOS Server 4 advisory and Unpatched Linux Distros plugin) reference this ...

CVE-2024-46831

The CVE-2024-46831 entry corresponds to a Linux kernel vulnerability in net: microchip: vcap where kunit tests trigger a use-after-free. The underlying issue is a use-after-free in kunit test code for vcap, which has been fixed by removing the problematic code and relying on checking the return v...

CVE-2024-56542

Summary of CVE-2024-56542: In the Linux kernel, drm/amd/display suffers a memleak during driver removal (amdgpu) due to incomplete cleanup in the takedown path. The trace shows memory manager not clean during takedown and a cascade through amdgpu_gtt_mgr_fini, amdgpu_ttm_fini, amdgpu_bo_fini, gmc...

CVE-2024-57805

CVE-2024-57805: In the Linux kernel ASoC: SOF: Intel: hda-dai, the link DMA was released on STOP, enabling a potential stream mix-up if a new stream starts before the previous is fully closed. This may lead to firmware errors or a crash. Root cause: releasing the link DMA on STOP rather than wait...

CVE-2024-58019

Technical details for CVE-2024-58019 are not publicly available in the provided documents; connected sources do not expose affected product/version, root cause, or remediation in this corpus. Monitor for updates.

CVE-2025-21930

CVE-2025-21930 affects the Linux kernel wireless subsystem (iwlwifi/mvm). The vulnerability arises when the driver talks to firmware that may be dead; before sending a command it now checks that the firmware is alive, preventing commands on an unresponsive firmware. Impact: local attacker could c...

CVE-2025-22123

CVE-2025-22123 relates to the Linux kernel’s F2FS filesystem. The issue arises when a faulty allocator path introduced by a commit (FAULT_NO_SEGMENT) may set curseg->segno to NULL_SEGNO while CP_ERROR_FLAG is set. This can lead to a page fault path where f2fs_write_inode() traverses a sequence...

CVE-2025-37814

In CVE-2025-37814, the Linux kernel fixed a policy on TIOCL_SELMOUSEREPORT: CAP_SYS_ADMIN is now required for all usages. The previous commit loosened this requirement, but the logic was inconsistent and TIOCL_SELMOUSEREPORT is mainly used by the mouse daemon (GPM/Consolation), which already runs...

CVE-2025-37821

The CVE-2025-37821 issue in the Linux kernel’s scheduler (eevdf) caused se->slice to be set to U64_MAX during a complex dequeue sequence, leading to a large, destabilizing vruntime/vlag mismatch and a potential crash. The root cause was that, when dequeuing a delayed group entity whose parent ...

CVE-2025-37922

CVE-2025-37922 concerns Linux kernel memory management: when section vmemmap start addresses are misaligned across namespaces, an altmap page may be reused by a different namespace, causing the previous namespace to free a page incorrectly and crash the kernel. The connected documents describe a ...

CVE-2025-38052

CVE-2025-38052 concerns the Linux kernel where a slab-use-after-free in net/tipc/crypto.c during tipc_aead_encrypt_done can occur after the tipc_crypto tx is freed when a namespace is deleted. The issue arises when simd_aead_encrypt is interrupted and crypto_simd_usable() returns false, allowing ...

CVE-2025-38186

CVE-2025-38186 (Linux kernel, bnxt_en/RoCE driver) : The issue arises from a double invocation path where bnxt_ulp_stop() and bnxt_ulp_start() can be invoked in sequence after bnxt_ulp_restart(), causing the RoCE driver’s aux driver suspend() to run twice and potentially dereference a NULL pointe...

CVE-2025-38206

CVE-2025-38206 concerns the Linux kernel exfat subsystem, where a double free could occur in the delayed_free pathway during exfat_kill_sb() via exfat_free_upcase_table(). The vulnerability arises when freeing vol_utbl twice due to an error return path in exfat_create_upcase_table() leading to a ...

CVE-2025-38219

CVE-2025-38219 affects the Linux kernel F2FS code path. The issue is a downgrade-related negative i_nlink scenario that could trigger a kernel warning; the vulnerability was resolved in the cited upstream code path (f2fs_i_links_write -> f2fs_drop_nlink -> f2fs_unlink), as shown in the conn...

CVE-2025-38412

CVE-2025-38412 affects the Linux kernel component platform/x86: dell-wmi-sysman. The issue arises from dereferencing WMI data blocks retrieved in sysfs callbacks without validating their content. The fix added is to validate the WMI data blocks after retrieval and before dereferencing their conte...

CVE-2025-38425

CVE-2025-38425 affects the Linux kernel i2c: tegra SMBUS block read path. Root cause: SMBUS block read reads the device-provided length without proper validation, continuing reads when length is 0 or exceeds allowed bytes. The vulnerability allows local attackers with lower privileges to potentia...

CVE-2026-23191

CVE-2026-23191 (Linux kernel — ALSA aloop) resolves a race in the aloop PCM trigger path that could cause a use-after-free when repeatedly opening/closing the tied stream. The vulnerability occurs because the trigger callback checks the PCM state and stops the tied substream outside the cable loc...

CVE-1999-0590

Technical details are not publicly available in the provided documents for CVE-1999-0590; no affected products, versions, impact, or remediation are specified. Monitor for updates from the connected sources.

CVE-2004-1073

The CVE-2004-1073 entry affects the Linux kernel (2.4.x up to 2.4.27 and 2.6.x up to 2.6.8). It is caused by the open_exec path of the execve functionality (exec.c), where the interpreter (PT_INTERP) handling can allow local users to read non-readable ELF binaries. The description specifies local...

CVE-2007-3380

The CVE-2007-3380 vulnerability affects the Linux kernel 2.6.15 Distributed Lock Manager (DLM). A remote attacker who can connect to the DLM port can cause a denial of service, potentially blocking DLM operations and affecting lock services. Connected advisories (RHSA-2007:0940, RHBA-2007:0861, E...

CVE-2007-5966

CVE-2007-5966 is a Linux kernel local privilege escalation: integer overflow in hrtimer_start (kernel/hrtimer.c) before 2.6.23.10 allows local users to run arbitrary code or cause a denial of service via a large relative timeout. Affected: Linux kernel versions prior to 2.6.23.10. Remediation: up...

CVE-2010-0008

CVE-2010-0008 affects the Linux kernel SCTP implementation prior to 2.6.23. The vulnerability in sctp_rcv_ootb allows remote attackers to cause a denial of service (infinite loop) via an Out Of The Blue (OOTB) chunk or a zero-length chunk. This CVE is also referenced in MiracleLinux AXSA-2010-166...

CVE-2010-3066

The CVE-2010-3066 issue affects the Linux kernel (fs/aio.c: io_submit_one) in versions prior to 2.6.23. A crafted io_submit call with IOCB_FLAG_RESFD can trigger a NULL pointer dereference, allowing a local user to cause a denial of service. The problem is rooted in the asynchronous I/O path (io_...

CVE-2010-4082

CVE-2010-4082 affects the Linux kernel prior to 2.6.36-rc5, where viafb_ioctl_get_viafb_info in drivers/video/via/ioctl.c fails to initialize a structure member. This can allow local users to leak potentially sensitive information from kernel stack memory via a VIAFB_GET_INFO ioctl call. The issu...

CVE-2011-0714

CVE-2011-0714 affects the Linux kernel 2.6.32 as patched for Red Hat Enterprise Linux 6, specifically involving the RPC server sockets functionality. The use-after-free vulnerability is triggered in a Red Hat patch related to lockd and the svc_xprt_received path, allowing remote attackers to cras...

CVE-2012-6549

The CVE-2012-6549 entry concerns the Linux kernel vulnerability where isofs_export_encode_fh in fs/isofs/export.c did not initialize a structure member, allowing local attackers to read sensitive data from kernel heap memory via a crafted application. Affected: Linux kernel versions prior to 3.6....

CVE-2012-6712

The CVE-2012-6712 issue affects the Linux kernel prior to 3.4, where a buffer overflow in the Intel Wireless iwlwifi driver (iwl-agn-sta.c) can cause memory corruption. Exploitation details are not provided in the documents, but the vulnerability is documented across multiple feeds with reference...

CVE-2013-2015

The vulnerability CVE-2013-2015 affects the Linux kernel’s ext4 implementation. Specifically, ext4/namei.c: the function ext4_orphan_del mishandles orphan-list entries for non-journal filesystems, allowing physically proximate attackers to cause a denial of service (system hang) by presenting a c...

CVE-2013-4592

CVE-2013-4592: Memory leak in Linux kernel

CVE-2013-6380

The CVE-2013-6380 entry concerns the Linux kernel up to version 3.12.1. The vulnerability exists in the aac_send_raw_srb function, located in drivers/scsi/aacraid/commctrl.c, where an insufficient validation of a size value allows a local attacker to trigger an invalid pointer dereference via an ...

CVE-2013-6381

CVE-2013-6381 describes a buffer overflow in the Linux kernel’s qeth_snmp_command function (drivers/s390/net/qeth_core_main.c) up to version 3.12.1, allowing local users to cause a denial of service (and potentially other impact) via an SNMP ioctl with an incompatible length. Connected documents ...

CVE-2016-2545

CVE-2016-2545 : Affected component is the Linux kernel; specifically the snd_timer_interrupt handler in sound/core/timer.c. The issue (pre-4.4.1) fails to maintain a linked list correctly, enabling local attackers to trigger a race condition via a crafted ioctl that can crash the system (denial o...

CVE-2016-6786

CVE-2016-6786 affects the Linux kernel’s performance subsystem: kernel/events/core.c mismanages locks during certain migrations, enabling a local user to escalate privileges. Public documents indicate this vulnerability exists in kernels before 4.0, with several Nessus advisories (Unity Linux/Mir...

CVE-2017-16534

CVE-2017-16534 affects the Linux kernel before 4.13.6, specifically the cdc_parse_cdc_header function in drivers/usb/core/message.c. A crafted USB device can trigger an out-of-bounds read, causing a local denial of service (system crash) and potentially other impact. The advisory notes this is a ...

CVE-2020-36789

The CVE-2020-36789 entry pertains to the Linux kernel CAN stack. A driver calling can_get_echo_skb() in hardware IRQ context could trigger WARN_ON(in_irq) in skb_release_head_state() under congestion, risking NULL pointer dereference. Root cause: kfree_skb() used instead of the IRQ-safe path in n...

CVE-2021-47212

CVE-2021-47212 affects the Linux kernel in the mlx5/ib stack. The issue arises in the fast unload flow where the device state enters internal error during a destroy command, causing a call path that would return EIO. The fix updates MLX5_CMD_OP_DESTROY_UCTX and MLX5_CMD_OP_DESTROY_UMEM to return ...

CVE-2021-47460

CVE-2021-47460 affects the ocfs2 code path in the Linux kernel. The vulnerability arises during conversion from inline inode data to extents, where the converter zeroed the entire data cluster by touching pages beyond i_size, which writeback may ignore, causing data loss after file growth. A fix ...

CVE-2021-47537

CVE-2021-47537 affects the Linux kernel in the octeontx2-af component, where in rvu_mbox_init() the mbox_regions pointer could be leaked on the switch-default path. The bug was a memory leak due to not freeing or returning the regions, and it is fixed by replacing a plain return err with a goto f...