CVE-2022-49017

CVE-2022-49017 (Linux kernel) : A use-after-free in Tipc processing was mitigated by re-fetching the skb control block from the newly allocated skb after tipc_msg_validate(), preventing dereferencing a freed skb. The issue manifested as a KASAN use-after-free in tipc_crypto_rcv_complete and relat...

CVE-2025-21903

CVE-2025-21903 affects the Linux kernel’s MCTP over I3C header handling: daddr may be NULL when no neighbour table entry exists, in which case the TX packet should be dropped; saddr may also be NULL if transmitted by a different protocol. The issue is escalated as a local vector with a Medium bas...

CVE-2025-22098

CVE-2025-22098 affects the Linux kernel’s DRM for ZynqMP DP. The issue is a deadlock in zynqmp_dp_ignore_hpd_set caused by attempting to lock the same mutex twice; the fix is to lock and unlock it properly (instead of locking twice). The vulnerability was identified by the Clang thread-safety ana...

CVE-2025-22112

CVE-2025-22112 affects the Linux kernel bnxt ethernet driver. The vulnerability arises from out-of-range access to the vnic_info array in bnxt_queue_start/stop where bp->nr_vnics is exceeded, allowing access to bp->vnic_info[bp->nr_vnics]. The issue is fixed in the publicly released comm...

CVE-2025-22114

CVE-2025-22114 (Linux kernel, btrfs) is fixed: the patch prevents clobbering the previously set return value in btrfs_validate_super() by ensuring validate_sys_chunk_array() does not wipe the early validity checks. The root cause is that the call to validate_sys_chunk_array() could overwrite ret,...

CVE-2025-37745

CVE-2025-37745 : Linux kernel vulnerability in the hibernate subsystem where a write to /sys/module/hibernate/parameters/compressor could deadlock with ieee80211 device registration. The root cause is a potential deadlock involving system_transition_mutex held under param_lock in hibernate_compre...

CVE-2025-37908

The CVE-2025-37908 issue affects the Linux kernel’s memory allocator slab subsystem. Root cause: slab->obj_exts was not reliably cleared during unaccount_slab() when mem_alloc_profiling_enabled() is false, allowing residual allocations to persist after shutdown_mem_profiling(). This can trigge...

CVE-2025-37918

CVE-2025-37918 affects the Azure Linux 3.0 kernel, specifically Bluetooth btusb handling of QCA firmware crash dumps on the WCN7851 (0489:e0f3). The issue is a NULL pointer dereference in skb_dequeue() caused by handle_dump_pkt_qca() returning 0 on success (and by forwarding the return value from...

CVE-2025-37959

CVE-2025-37959 – Linux kernel : Vulnerability in bpf_redirect_peer where redirecting a packet to a device in another network namespace could leave skb metadata (namespace-bound state) from the host in the container namespace, enabling potential information leakage. The patch scrubs the packet on ...

CVE-2025-38075

CVE-2025-38075 affects the Linux kernel iscsi target/scsi subsystem. A NOPIN response timer could be restarted on expiration for a deleted connection, causing a NULL pointer dereference and a crash in iscsit_fill_cxn_timeout_err_stats during timeout handling. The root cause is the nopin timer bei...

CVE-2025-38113

CVE-2025-38113 affects the Linux kernel: ACPI: CPPC: Fix NULL pointer dereference when nosmp is used. With nosmp in the kernel command line, CPUs aren’t brought up and their cpc_desc_ptr can be NULL, leading to NULL dereferences when CPU0 iterates over possible CPUs and panics. The issue is docum...

CVE-2025-38283

CVE-2025-38283 is addressed in Azure Linux 3.0 kernel updates. The issue in hisi_acc_vfio_pci caused a NULL data address during live migration when no VF device driver is loaded in the guest, leading to potential access errors on the destination during device data migration. The fix ensures live ...

CVE-2025-38300

CVE-2025-38300: In the Linux kernel sun8i-ce-cipher path (sun8i_ce_cipher_prepare), two DMA cleanup issues on the error path are fixed. 1) On the theend_sgs error path, dma_unmap is now performed only if the corresponding dma_map_sg() succeeded for areq->dst. 2) On the theend_iv path, dma_unma...

CVE-2025-38393

CVE-2025-38393 is a Linux kernel race condition in NFSv4/pNFS wake logic for NFS_LAYOUT_DRAIN in pnfs_update_layout(). The issue occurs when a waiter and waker race, causing writeback/page lock hang; a barrier-based fix is applied. Public advisories/DB entries confirm the fix across multiple kern...

CVE-2025-38544

CVE-2025-38544 : The Linux kernel’s rxrpc implementation had a bug where preallocated call IDs could collide, triggering cleanup assertions when an in-use ID was released. The fix sets the call state in rxrpc_service_prealloc_one() and marks the call as released before cleanup, preventing both as...

CVE-2026-22990

CVE-2026-22990 affects the Linux kernel libceph component, where an overzealous BUG_ON in osdmap_apply_incremental() could misreact to a maliciously corrupted incremental osdmap epoch. The mitigation is to treat such an incongruent incremental osdmap as invalid rather than triggering a BUG. Conne...

CVE-2026-46056

The CVE-2026-46056 entry documents a Linux kernel Bluetooth UAF vulnerability in the SSP passkey handlers (hci_event path). The issue arises when hci_conn lookup and field access are performed without holding the hdev lock, creating a window where a connection could be freed concurrently in hci_u...

CVE-1999-0165

Technical details about CVE-1999-0165 are not publicly available in the provided documents; no concrete affected products, versions, or fixes are specified. Monitor for updates from vendors and CVE sources.

CVE-2005-0736

CVE-2005-0736 entry is rejected/not used and does not represent an active vulnerability.

CVE-2006-7203

CVE-2006-7203 affects the Linux kernel 2.6.20 and earlier, via compat_sys_mount in fs/compat.c. When mounting a smbfs filesystem in compatibility mode (mount -t smbfs), a local user can trigger a NULL pointer dereference (and oops), leading to denial of service. Publicly documented references (RH...

CVE-2010-0410

CVE-2010-0410 affects the Linux kernel up to version 2.6.32.7, via drivers/connector/connector.c, allowing local users to cause memory exhaustion and a system crash by flooding NETLINK_CONNECTOR messages. The MiracleLinux advisories (AXSA:2010-285:05 and AXSA:2010-323:11) explicitly include CVE-2...

CVE-2011-3637

CVE-2011-3637 is a vulnerability in the Linux kernel where the m_stop function in fs/proc/task_mmu.c can trigger an OOPS via vectors that cause an m_start error. Affected: Linux kernel versions prior to 2.6.39 (i.e., 2.6.38 and earlier). Impact: local denial of service (kernel oops) without remot...

CVE-2016-2063

CVE-2016-2063 is a stack-based overflow in the MSM Thermal driver for the Linux kernel 3.x. The vulnerability resides in supply_lm_input_write within drivers/thermal/supply_lm_core.c and can be triggered by sending a large amount of data via the debugfs interface, enabling a local attacker to cau...

CVE-2016-2067

CVE-2016-2067 affects the Linux kernel MSM GPU driver: drivers/gpu/msm/kgsl.c in the MSM graphics driver (QuIC Android contributions) for kernel 3.x. The root cause is mishandling of the KGSL_MEMFLAGS_GPUREADONLY flag, which can create accidental read/write mappings. This enables a local attacker...

CVE-2017-17855

CVE-2017-17855 affects Linux kernel versions up to 4.14.8 in kernel/bpf/verifier.c, where improper use of pointers in place of scalars allows local users to cause a denial of service via memory corruption (impact described as high). The provided documents do not supply a confirmed exploit, mitiga...

CVE-2017-9985

CVE-2017-9985 is a local double-fetch vulnerability in the Linux kernel (snd_msndmidi_input_read in sound/isa/msnd/msnd_midi.c) affecting up to version 4.11.7. Exploitation can cause denial of service (over-boundary access) with potential unspecified impact. Public references in Nessus/OpenVAS/U-...

CVE-2021-47087

The CVE-2021-47087 entry concerns the Linux kernel: tee: optee fix for an incorrect page free bug. The issue arises when a pointer to an allocated struct page is already advanced near the end of allocation, making __free_pages(page, order) unsafe if the pointer isn’t reset. The documented fix sto...

CVE-2021-47111

CVE-2021-47111 affects the Linux kernel xen-netback where the RX task thread could be freed before kthread_stop during backend teardown, causing a use-after-free. The fix reintroduces taking a reference to the RX task thread and adds an explanation why it’s needed (XSA-374 / CVE-2021-28691). Affe...

CVE-2021-47170

CVE-2021-47170 (Linux kernel) is described in the initial document as a benign user‑request issue where usbfs would emit a WARN when a user submits an excessively large memory allocation for bulk transfers. The vulnerability is not a flaw in kernel logic, but a misinterpretation of invalid reques...

CVE-2021-47176

CVE-2021-47176 affects the Linux kernel s390/dasd subsystem. The issue arises from an omitted discipline function, leading to a panic when the path verification function is invoked for FBA or DIAG devices. A fix defines a wrapper for dasd_generic_verify_path() to restore correct operation and pre...

CVE-2021-47231

The Linux kernel contains a memory leak vulnerability in the SocketCAN driver for the Microchip CAN BUS Analyzer Tool (mcba_usb ). The issue arises because 20 coherent buffers allocated in mcba_usb_start() are never freed; specifically, the URB_FREE_BUFFER flag is missing in the disconnect functi...

CVE-2021-47301

Summary: CVE-2021-47301 affects the Linux kernel igb/igc driver stack. Root cause: a use-after-free in the reset path where next_to_watch is not cleared while cleaning the TX ring, risking a freed skb being freed again if igb_poll() executes during reset. Impact: potential invalid memory accesses...

CVE-2021-47324

The Linux kernel contains a use-after-free vulnerability in the wdt_startup() function within the drivers/watchdog/sbc60xxwdt.c module. The issue occurs because the module's remove path calls del_timer(), which does not wait for the timer handler to finish, allowing the handler to execute after t...

CVE-2021-47358

CVE-2021-47358 concerns the Linux kernel staging/greybus uart use-after-free vulnerability. The root cause is improper lifetime management of greybus tty state after disconnect, allowing user-space processes to hold an open tty indefinitely and for tty drivers to release underlying structures whi...

CVE-2021-47374

CVE-2021-47374 concerns the Linux kernel DMA debugging code (kernel/dma/debug.c). The issue arises when drivers using the DMA API emit an error condition frequently, causing a flood of printk messages that can drive CPU usage to 100%. The documented fix switches handling from simple rate limiting...

CVE-2021-47418

CVE-2021-47418 refers to a Linux kernel vulnerability in net_sched: a NULL pointer dereference inside fifo_set_limit() that could OOPS when adjusting limits on certain qdiscs (notably pfifo_fast, which lacks a change() operation). The issue was reproduced via syzbot and the fix makes fifo_set_lim...

CVE-2021-47516

CVE-2021-47516 concerns a memory‑leak in the Linux kernel’s nfp_cpp_area_cache_add() path. In the function, area = nfp_cpp_area_alloc(..., size) is allocated (#1). If the subsequent cache allocation kzalloc(sizeof(*cache), GFP_KERNEL) fails, the code returns -ENOMEM without freeing the previously...

CVE-2021-47521

CVE-2021-47521 affects the Linux kernel via can: sja1000: fix use after free in ems_pcmcia_add_card(). The fix ensures that when the last channel is unavailable, dev is freed and pdev->irq can be used instead, with an additional check that at least one channel was set up. In the available docu...

CVE-2021-47547

The Linux kernel contains an out-of-bounds array access vulnerability within the net: tulip: de4x5 component. Specifically, in line 5001, if all values in the array lp->phy[8] are non-zero, the loop variable k reaches 8 at the end of the loop, potentially leading to an out-of-bounds access. Th...

CVE-2021-47555

Summary (supported by provided docs): In the Linux kernel, the VLAN real_dev refcnt underflow was fixed. The issue occurred when an error was injected before dev_hold(real_dev) in register_vlan_dev(), causing the real_dev refcount to underflow and triggering a warning and an endless wait-loop dur...

CVE-2021-47641

CVE-2021-47641 (Linux kernel) affects the video fbdev Cirrus driver (cirrusfb) within the kernel’s fbdev subsystem. The issue arises in cirrusfb_check_pixclock when pixclock can be zero, causing a divide by zero that Syzkaller reported. The driver then rounds up pixclock to approximate maxclock, ...

CVE-2022-3526

CVE-2022-3526 is a Linux kernel issue affecting the macvlan_handle_frame path in drivers/net/macvlan.c (skb). The connected OSV advisory (SUSE-SU-2022:4617-1) confirms a memory-leak vulnerability associated with CVE-2022-3526 and lists it among the fixed issues in kernel updates for SUSE Linux En...

CVE-2022-48863

The CVE-2022-48863 entry describes a Linux kernel vulnerability in mISDN: dsp_pipeline_build() leaks memory due to dup pointer handling. Specifically, dsp_pipeline_build() allocates dup with kstrdup(cfg) and then updates dup via strsep(&dup, "|"), leaving dup as NULL when kfree(dup) is called. Th...

CVE-2022-49164

CVE-2022-49164 describes a Linux kernel vulnerability on PowerPC with TM (transaction memory) that could corrupt the user r13 register due to a SLB miss during treclaim/trechkpt handling. The issue occurs when SCRATCH0 is live with the saved user r13 value, which can be clobbered by the kernel r1...

CVE-2022-49265

The CVE-2022-49265 issue affects the Linux kernel where removing a genpd with GENPD_FLAG_IRQ_SAFE could trigger a sleep-in-atomic bug because genpd_debug_remove() is called with a spinlock held. Affected context includes call paths like debugfs_lookup and genpd_remove, leading to a sleeping funct...

CVE-2022-49359

CVE-2022-49359 : In Linux kernel’s DRM Panfrost handling, a use-after-free occurs when a panfrost_priv is freed but a job structure continues to reference it to obtain the MMU context. The fix drops the panfrost_priv reference from the job and adds a direct reference to the MMU structure that is ...

CVE-2022-49367

Summary (CVE-2022-49367) In the Linux kernel, the mv88e6xxx DSA MDIO registration path contains a refcount leak. The function of_get_child_by_name() returns a node pointer with an incremented refcount, but of_node_put() is not called when finished, leaking references. mv88e6xxx_mdio_register() fo...

CVE-2022-49418

The CVE-2022-49418 entry concerns a Linux kernel NFSv4 crash during referral lookup caused by using an uninitialized nfs4_label. The fix, as described in the provided documents, sends along the already-allocated fattr with nfs4_fs_locations and drops the memcpy of fattr, which avoids two extra al...

CVE-2022-49522

CVE-2022-49522 concerns a Linux kernel MMC driver issue (mmc: jz4740) where DMA maps could exceed the DMA engine’s capabilities. The root cause is not a research-level flaw but an inadequate limit on the maximum segment size for DMA data transfers. The fix enforces DMA engine limits on the jz4740...

CVE-2022-49529

CVE-2022-49529 affects the Linux kernel’s DRM/AMDGPU PM code. Root cause: during context release with software SMU disabled, pp_funcs may be uninitialized, causing a NULL pointer dereference and kernel panic (as shown by the amdgpu_dpm_force_performance_level trace). The vulnerability is resolved...