CVE-2014-1690

The vulnerability CVE-2014-1690 affects the Linux kernel’s net/netfilter/nf_nat_irc.c before 3.12.8. An IRC DCC session with incorrect NAT mangle data can allow a remote attacker to read kernel memory. Impact is information disclosure; exploitation context is remote over the network. The fixed ve...

CVE-2016-6786

CVE-2016-6786 affects the Linux kernel’s performance subsystem: kernel/events/core.c mismanages locks during certain migrations, enabling a local user to escalate privileges. Public documents indicate this vulnerability exists in kernels before 4.0, with several Nessus advisories (Unity Linux/Mir...

CVE-2017-13715

The CVE-2017-13715 issue affects the Linux kernel (net/core/flow_dissector.c). The __skb_flow_dissect function can fail to initialize n_proto, ip_proto, and thoff, enabling a remote attacker to trigger a denial of service (system crash) or potentially execute arbitrary code via a crafted MPLS pac...

CVE-2018-6559

CVE-2018-6559 affects the Linux kernel overlayfs in Ubuntu 18.04/18.10. The vulnerability arises when mapping directory contents permissions inside nested user namespaces; a local attacker could exploit this to reveal names of files they would not normally access, bypassing some access controls. ...

CVE-2019-16921

In the Linux kernel before 4.17, hns_roce_alloc_ucontext in drivers/infiniband/hw/hns/hns_roce_main.c does not initialize the resp data structure, which may allow attackers to read sensitive information from kernel stack memory (CID-df7e40425813). This CVE affects the kernel code path associated ...

CVE-2021-47087

The CVE-2021-47087 entry concerns the Linux kernel: tee: optee fix for an incorrect page free bug. The issue arises when a pointer to an allocated struct page is already advanced near the end of allocation, making __free_pages(page, order) unsafe if the pointer isn’t reset. The documented fix sto...

CVE-2021-47235

CVE-2021-47235 affects the Linux kernel net/ethernet path: ec_bhf_remove() uses priv (netdev private data) after free_netdev() is called, enabling a use-after-free. The fixed sequence moves free_netdev() to occur after the PCI I/O unmaps (pci_iounmap) of priv, preventing access to freed memory. D...

CVE-2021-47269

CVE-2021-47269 is a Linux kernel issue in the DesignWare USB3 (dwc3) ep0 handling. The root cause is missing validation of the ep index from dwc3_wIndex_to_dep(), which can lead to referring to a non-existing endpoint and a NULL pointer dereference in certain configurations (e.g., composite devic...

CVE-2021-47323

CVE-2021-47323 affects the Linux kernel watchdog driver sc520_wdt: use-after-free can occur if timer removal uses del_timer() during device removal. The issue is addressed by replacing del_timer() with del_timer_sync() to ensure the timer handler finishes before teardown, preventing potential use...

CVE-2021-47382

The CVE-2021-47382 entry concerns the Linux kernel component s390/qeth. Root cause: a deadlock risk in qeth_do_reset() where discipline_mutex could be held on an error path, preserving the original deadlock potential when a qeth channel path is offline. The vulnerability arises from a race betwee...

CVE-2021-47506

CVE-2021-47506 : Linux kernel NFS delegation race in nfsd fixed to address a use-after-free via del_recall_lru when a delegation could be freed after vfs_setlease and callback processing. Symptoms include use-after-free and list corruption in laundromat threads. Connected sources (Astra Linux adv...

CVE-2022-3977

CVE-2022-3977 is a use-after-free in the Linux kernel MCTP implementation. It occurs when a user performs a DROPTAG ioctl while a socket close happens, potentially crashing the system or allowing local privilege escalation. The issue is documented across multiple sources (NVD entry and OSV/GNU-fa...

CVE-2022-48656

CVE-2022-48656 relates to a refcount leak in Linux kernel dmaengine: ti: k3-udma-private (of_xudma_dev_get). The issue stems from a missing of_node_put() in the error/fail path, causing a reference leak. The fix moves of_node_put() before the check to ensure proper reference handling. Impact is m...

CVE-2022-48875

CVE-2022-48875 affects the Linux kernel’s wireless stack (mac80211). The vulnerability arises when AMPDU start handling in the driver path can encounter a NULL sdata during deauthentication, leading to a NULL dereference. Specifically, ieee80211_tx_ba_session_handle_start() may receive NULL for s...

CVE-2022-48995

Mode C: Concrete details found. Affected component: Linux kernel module raydium_ts_i2c (raydium_i2c_ts) using sunray/raydium_i2c_send().Root cause: memory leak during i2c bank switching; tx_buf is not freed after BANK_SWITCH on i2c BUS operations, creating kmemleak objects in test with a bpf mock...

CVE-2022-49019

Converging sources confirm CVE-2022-49019 affects the Linux kernel nixge Ethernet driver. The issue is a NULL dereference in nixge_hw_dma_bd_release() when priv->rx_bd_v is invalid due to a prior allocation failure in nixge_hw_dma_bd_init(). A fix exists that moves the for() loop dereferencing...

CVE-2022-49189

CVE-2022-49189 : In the Linux kernel (clk-rcg2, Qualcomm display pixel clock), final D calculation for the M/N ratio could fall outside the accepted range, causing underflow. The fix updates the D-value calculation to respect the valid range for given M and N, preventing underflow. Affected compo...

CVE-2022-49234

CVE-2022-49234 is a Linux kernel vulnerability in the VLAN filtering path for DSA cross-chip setups. The issue: when a switch (sw1) p4 leaves a bridge, dsa_port_vlan_filtering would also be invoked for sw2p1 and sw3p1, potentially referencing a non-existent port and causing array out-of-bounds ac...

CVE-2022-49241

CVE-2022-49241 affects the Linux kernel ASoC: atmel subsystem, specifically the sam9x5_wm8731_driver_probe. The root cause is a device_node pointer returned by of_parse_phandle() with refcount incremented, but of_node_put() is not invoked in the error path, causing a refcount leak. The fix adds p...

CVE-2022-49320

The CVE-2022-49320 entry concerns the Linux kernel dmaengine for ZynqMP DMA. The root cause is an overflow risk in zynqmp_dma_alloc/free_chan_resources where 32-bit operands are used in size calculations (2 * chan->desc_size * ZYNQMP_DMA_NUM_DESCS). The fix changes the desc_size data type to s...

CVE-2022-49359

CVE-2022-49359 : In Linux kernel’s DRM Panfrost handling, a use-after-free occurs when a panfrost_priv is freed but a job structure continues to reference it to obtain the MMU context. The fix drops the panfrost_priv reference from the job and adds a direct reference to the MMU structure that is ...

CVE-2022-49420

CVE-2022-49420 documents a data race in the Linux kernel involving UDP path: UDP sendmsg() reads sk->sk_bound_dev_if while it can be changed by another thread, and UDP wake/receive paths around __ip6_datagram_connect and udpv6_sendmsg. The issue is in net/ipv6/udp.c and related dgram/connect c...

CVE-2022-49437

CVE-2022-49437 affects the Linux kernel (powerpc/xive) where a refcount leak occurs in xive_spapr_init due to a missing of_node_put() after of_find_compatible_node() returns a node with an incremented refcount. The provided description specifies that the fix adds the missing of_node_put() to avoi...

CVE-2022-49440

CVE-2022-49440 affects the Linux kernel (PowerPC RTAS path). The root cause is MSR[RI] not being preserved when entering RTAS, while RTAS runs in real mode and may trigger a panic/ watchdog lockup if MSR[RI] is unset. The fix updates how MSR is computed before calling RTAS, ensuring a hardcoded v...

CVE-2022-49505

Mode C: The CVE-2022-49505 issue affects the Linux kernel NFC subsystem. The root cause is a UAF (use-after-free) of the rfkill object in the NFC device handling: during nfc_dev_up() and related operations, the rfkill state could be dereferenced if the device is removed via nfc_unregister_device(...

CVE-2022-49620

CVE-2022-49620 (Linux kernel, net: tipc) Affects the Tipc subsystem: a potential refcount leak in tipc_sk_create() when tipc_sk_insert() fails. The fix ensures the sk is freed on failure, preventing a leak. The public description notes local attack vector with low privileges required and no user ...

CVE-2022-49693

CVE-2022-49693 : In the Linux kernel, there is a refcount leak in the drm/msm/mdp4 path during mdp4_modeset_init_intf caused by not releasing the remote device node pointer obtained from of_graph_get_remote_node(). The pointer’s refcount is incremented but not decremented with of_node_put() when ...

CVE-2022-49711

The CVE-2022-49711 issue affects the Linux kernel in the bus: fsl-mc-bus path. Root cause: in fsl_mc_bus_remove(), mc->root_mc_bus_dev->mc_io is passed to fsl_destroy_mc_io() after mc->root_mc_bus_dev has already been freed in fsl_mc_device_remove(), causing a KASAN use-after-free. Mitig...

CVE-2022-49749

The CVE-2022-49749 issue is confirmed in the Linux kernel’s I2C designware driver. In i2c_dw_scl_lcnt() and i2c_dw_scl_hcnt(), multiplying ic_clk by constant factors could overflow 32-bit arithmetic, depending on ic_clk (e.g., ic_clk > 1 MHz). The patch adds a 64-bit cast (u64) to the calculat...

CVE-2022-49770

CVE-2022-49770 describes a Linux kernel issue in the Ceph-related path where decoding snaps could leave first_realm and realm pointing to the same snaprealm memory, causing a use-after-free or BUG_ON. The description in the sources confirms the fix was applied to avoid putting the realm twice whe...

CVE-2022-49809

CVE-2022-49809 affects the Linux kernel in the x25 subsystem (net/x25). The vulnerability arises in x25_lapb_receive_frame() where skb_copy() is used to obtain a private copy of skb; if the new skb is not freed in the undersized/fragmented skb error handling path, a memory leak occurs. The provid...

CVE-2022-49983

The issue CVE-2022-49983 affects the Linux kernel udmabuf driver. If the udmabuf DMA mask is not set explicitly, userspace DMA-BUF access via the CPU can trigger a warning in dma_map_sg_attrs (kernel/dma/mapping.c) during dma-buf CPU access flows (as shown in the stack trace). The vulnerability i...

CVE-2023-52692

The CVE-2023-52692 entry concerns the Linux kernel ALSA Scarrett2 path: scarlett2_usb_set_config() calls scarlett2_usb_get() but does not verify its return value, continuing with an invalid value if get() fails. The vulnerability is resolved by returning the error from scarlett2_usb_get() instead...

CVE-2023-52694

CVE-2023-52694 relates to the Linux kernel drm/bridge tpd12s015 driver. The issue arises from marking tpd12s015_remove() with __exit, which causes the function to be discarded when the driver is built-in; on unbind, cleanup may be skipped, leading to resource leakage. The vulnerability was resolv...

CVE-2023-52829

The connected documents do not provide additional technical details beyond the initial description. Public information on CVE-2023-52829 is not expanded here; monitor for updates.

CVE-2023-52894

CVE-2023-52894 affects the Linux kernel USB gadget f_ncm path, where a NULL cdev->gadget dereferences max_speed in ncm_bitrate() during SPEED_NOTIFY handling. The issue was observed on an aarch64 GKI 5.10.149-android13 crash (NULL pointer dereference at 0x5c) and is linked to ncm_do_notify() S...

CVE-2024-26715

CVE-2024-26715 affects the Linux kernel's USB subsystem, specifically the DWC3 gadget driver. The issue is a NULL pointer dereference in dwc3_gadget_suspend that can occur when plug-out/plug-in cycles race with gadget_driver being cleared, allowing a path where a non-NULL dwc->gadget_driver is...

CVE-2024-35883

CVE-2024-35883 affects the Linux kernel's PCI SPI driver for mchp-pci1xxx. The issue is a potential null pointer dereference in pci1xxx_spi_probe caused by a failed devm_kzalloc, leading to dereferencing a null when spi_int/iter is accessed. Mitigation in the cited fix is to check spi_bus->spi...

CVE-2024-35987

CVE-2024-35987 relates to the Linux kernel on RISCV NOMMU. The issue arose from enabling a linear mapping that used RAM below the kernel load address, which breaks NOMMU because PAGE_OFFSET is fixed to the load address. As a result mm initialization can start at mem_map and corrupt adjacent kerne...

CVE-2024-35988

CVE-2024-35988 concerns the Linux kernel RISCV NOMMU patch that corrects TASK_SIZE for 64-bit NOMMU. The current TASK_SIZE definition caused spurious failures in userspace memory access when any RAM above 4 GiB existed, leading to incorrect memory access behavior. The vulnerability is resolved by...

CVE-2024-38550

CVE-2024-38550 : In the Linux kernel, the ASoC kirkwood code fix prevents a potential NULL dereference in kirkwood_dma_hw_params by guarding the mv_mbus_dram_info() return value when CONFIG_PLAT_ORION is not defined. The vulnerability arises because mv_mbus_dram_info() can return NULL, and derefe...

CVE-2024-40985

CVE-2024-40985 concerns the Linux kernel TCP-AO subsystem. The issue is described as: in net/tcp_ao, ao_info could be leaked on error-path, introduced with TCP_AO_CMDF_AO_REQUIRED in patch set version 5. The vulnerability’s root cause is an information leak during error handling in the TCP-AO cod...

CVE-2024-43827

In CVE-2024-43827, the Linux kernel DRM AMD display path (drm/amd/display) was fixed by adding a null check before accessing internal structs in enable_phantom_plane. Root cause: missing null pointer validation. Impact, as per CVSS: local, low complexity, low privileges required; confidentiality/...

CVE-2024-43845

CVE-2024-43845 concerns the Linux kernel udf implementation. The documented issue is a bogus checksum computation in udf_rename(), triggered when updating the checksum of the '..' directory entry in a moved directory. Syzbot noted an uninitialized memory access because on-stack diriter.fi is pass...

CVE-2024-45029

CVE-2024-45029 affects the Linux kernel i2c Tegra driver on ACPI machines. The root cause is a mutex being used inside a spinlock during power-runtime handling, which can lead to a sleeping function call from an invalid context when __pm_runtime_resume() triggers acpi_subsys_runtime_resume(). The...

CVE-2024-47708

CVE-2024-47708 : In the Linux kernel, the netkit driver missed assigning the required bpf_net_context during XDP-redirect handling, causing a NULL pointer dereference when NETKIT_REDIRECT invokes skb_do_redirect() and accesses per-CPU variables. The fix is to set the bpf_net_context before callin...

CVE-2024-49943

CVE-2024-49943 affects the Linux kernel DRM XE driver (guc_submit_wedged_fini). A missing locking around wedged_fini permits a use-after-free when a non-wedged queue is dereferenced concurrently with an async queue destroy. The fix is to hold the submission_state lock during the wedge-status chec...

CVE-2024-57923

CVE-2024-57923 covers a Linux kernel issue in btrfs zlib HW compression on s390 where input length passed to zlib_compress_folios() could exceed input range due to strm.avail_in calculation becoming a multiple of PAGE_SIZE. The result is an assertion in btrfs_compress_folios() (total_in > orig...

CVE-2025-21977

CVE-2025-21977 : Linux kernel hyperv_fb vulnerability affecting Gen2 Hyper‑V VMs. When the kdump kernel loads, efifb may hang due to the Hyper‑V framebuffer being moved to a new MMIO address and the kdump screen_info using the original address. Root cause: framebuffer relocation is not reset for ...

CVE-2025-22046

CVE-2025-22046: In the Linux kernel, the uprobes/x86 uretprobe trampoline check was hardened to prevent a trampoline_check_ip path that could allow a call into the syscall from memory addresses near the bottom of the address space if uretprobes were not set up. Root cause: trampoline_check_ip cou...