CVE-2024-47724

Technical details for CVE-2024-47724 (affected component, root cause, impact, remediation) are not provided in the supplied documents. Monitor for updates from official kernel advisories and vendor advisories.

CVE-2024-49872

The CVE-2024-49872 issue affects the Linux kernel in mm/gup where memfd_pin_folios can race when creating a hugetlb folio and another actor has already done so, leading to a -EEXIST and a panicking folio_put call if the same folio is used in the next loop iteration. The patch fixes the race by cl...

CVE-2024-50173

The CVE-2024-50173 entry concerns the Linux kernel DRM panthor driver: tick_ctx_cleanup() could access an uninitialized or invalid group-derived ptdev due to using a group variable in the second loop. The fix replaces the approach with obtaining the ptdev object from the scheduler, preventing der...

CVE-2024-56669

CVE-2024-56669 (Linux kernel): Fix for cache tag leakage in VT-d IOMMU when disabling ATS that could cause use-after-free and kernel crash, notably with multiple VFs via vfio-pci. Root cause: cache tags were removed after ATS disable, leaving CACHE_TAG_DEVTLB entries in the domain’s list. The pat...

CVE-2024-56713

Technical details for CVE-2024-56713 are not provided in the connected documents. The initial description mentions nsim_pp_hold_write() issues in the Linux kernel but lacks explicit product/version/remediation details. Monitor for authoritative updates.

CVE-2024-57923

CVE-2024-57923 covers a Linux kernel issue in btrfs zlib HW compression on s390 where input length passed to zlib_compress_folios() could exceed input range due to strm.avail_in calculation becoming a multiple of PAGE_SIZE. The result is an assertion in btrfs_compress_folios() (total_in > orig...

CVE-2025-21911

CVE-2025-21911 concerns the Linux kernel DRM/imagination path where fence release could deadlock due to in-function fence release processing. The fix moves scheduler queue fence release processing to a workqueue, avoiding recursive locking (illustrated by a deadlock involving reservation_ww_class...

CVE-2025-22051

CVE-2025-22051 affects the Linux kernel staging gpib driver. The issue arises when an Agilent USB dongle is disconnected, causing a NULL pointer Oops on subsequent driver calls because bus_interface is set to NULL on disconnect. The root cause is that usb_dev was being assigned from the bus_inter...

CVE-2025-22076

CVE-2025-22076 is a Linux kernel vulnerability in exfat handling. The root cause is missing shutdown checks in several I/O paths: read_iter, and later write_iter, splice_read, and mmap. This allowed a device deletion to leave dirty data readable, per the description. The fix adds shutdown checks ...

CVE-2025-22114

CVE-2025-22114 (Linux kernel, btrfs) is fixed: the patch prevents clobbering the previously set return value in btrfs_validate_super() by ensuring validate_sys_chunk_array() does not wipe the early validity checks. The root cause is that the call to validate_sys_chunk_array() could overwrite ret,...

CVE-2025-37774

The CVE-2025-37774 entry describes a Linux kernel slab allocator issue where slab->obj_exts may be left non-zero on newly allocated slabs, causing invalid pointer dereferences and potential Oops/panic during buffered I/O operations. Investigation notes that bits in slab->obj_exts could esca...

CVE-2025-37822

CVE-2025-37822 resolves a Linux kernel issue in the RISC‑V uprobes path. The root cause was a missing fence.i after constructing the XOL (execute out-of-line) buffer used to single-step replaced instructions, which could lead to execution of stale/broken instructions. The vulnerability was observ...

CVE-2025-37918

CVE-2025-37918 affects the Azure Linux 3.0 kernel, specifically Bluetooth btusb handling of QCA firmware crash dumps on the WCN7851 (0489:e0f3). The issue is a NULL pointer dereference in skb_dequeue() caused by handle_dump_pkt_qca() returning 0 on success (and by forwarding the return value from...

CVE-2025-37965

Concretely described CVE-2025-37965 affects the Linux kernel DRM/AMD display code. The root cause is GFP_KERNEL memory allocations in populate_dml_plane_cfg_from_plane_state(), which are unsafe in atomic contexts. The fix removes dynamic allocations by passing a pointer to scaler_data within the ...

CVE-2025-38011

Summary: CVE-2025-38011 affects the Linux kernel DRM/amdgpu path (csa unmapping). The root cause is a use of an interruptible lock while unmapping the CSA and freeing GPU VM, which could lead to a memory leak and a warning backtrace when a signal is accepted after process exit and a VM lock wait ...

CVE-2025-38102

The CVE CVE-2025-38102 describes a race in VMCI within the Linux kernel between vmci_host_setup_notify and vmci_ctx_unset_notify. A warning can be triggered in try_grab_folio due to a still-in-progress get_user_pages_fast writing to context->notify_page, which may be observed and mismanaged du...

CVE-2025-38103

CVE-2025-38103 relates to the Linux kernel HID path (usbhid). The issue, described in connected sources, is an out-of-bounds bug in usbhid_parse() that could arise from HID descriptor handling. The fix updates the HID descriptor struct to align with USB HID 1.11 (reflecting mandatory vs. optional...

CVE-2025-38146

The CVE CVE-2025-38146 concerns the Linux kernel net/openvswitch MPLS parsing dead loop when handling MPLS stacks, where the label count may wrap and an invalid index (-1) can occur in key_extract_l3l4, causing a potential soft lockup/CPU stall. Affected: Linux kernel with openvswitch MPLS flow p...

CVE-2025-38181

CVE-2025-38181 affects the CALIPSO path in the Linux kernel. The root cause is a null pointer dereference in calipso_req_setattr() when CALIPSO option handling fetches a sock via sk_to_full_sk(), which could leave reqsk->rsk_listener NULL. The issue is tied to a previous commit around SYN Cook...

CVE-2025-38328

CVE-2025-38328 concerns the Linux kernel JFFS2 subsystem. The issue arises from insufficient validation after jffs2_prealloc_raw_node_refs() completion, allowing a null pointer dereference in jffs2_link_node_ref and leading to a local, attacker-controlled disruption as described by the Syzkaller ...

CVE-2025-38334

In CVE-2025-38334, the Linux kernel SGX path could reclaim EPC pages that are poisoned. Root cause: epc_page->poison is set during memory failure but the reclaimer logic does not check it, so poisoned EPC pages could be reclaimed and written out with EWB microcode operations, risking enclosure...

CVE-2007-4997

CVE-2007-4997 affects the Linux kernel 2.6.x, including components in net/ieee80211/ieee80211_rx.c, where an off-by-two integer underflow in ieee80211_rx can crash the kernel when a runt IEEE 802.11 frame with the IEEE80211_STYPE_QOS_DATA flag is used. Impact is remote denial of service (kernel c...

CVE-2009-1633

The CVE-2009-1633 issue affects the Linux kernel CIFS subsystem prior to 2.6.29.4. It describes multiple buffer overflows in CIFS that can be triggered by a malformed Unicode string (Unicode string area alignment in fs/cifs/sess.c) or long Unicode characters (fs/cifs/cifssmb.c and fs/cifs/readdir...

CVE-2010-4076

CVE-2010-4076 affects Linux kernel 2.6.36.1 and earlier. The rs_ioctl function in drivers/char/amiserial.c does not initialize a structure member, enabling local users to read potentially sensitive information from kernel stack memory via TIOCGICOUNT. A fix is to apply the kernel update that addr...

CVE-2010-4079

CVE-2010-4079 affects the Linux kernel ivtvfb driver (ivtvfb_ioctl in drivers/media/video/ivtv/ivtvfb.c) prior to 2.6.36-rc8. The root cause is failure to initialize a structure member, enabling local users to leak information from kernel stack memory via the FBIOGET_VBLANK ioctl. Affected versio...

CVE-2011-1170

CVE-2011-1170 affects the Linux kernel prior to 2.6.39 where net/ipv4/netfilter/arp_tables.c does not place the expected null terminator at the end of certain string values. This can allow a local user with CAP_NET_ADMIN to craft a request and read the argument to the modprobe process, potentiall...

CVE-2011-2495

CVE-2011-2495 affects the Linux kernel prior to 2.6.39.4. The issue is in fs/proc/base.c where access to /proc/#####/io is insufficiently restricted, allowing local users to poll a file and infer sensitive I/O statistics (e.g., length of another user’s password). The MiracleLinux advisories refer...

CVE-2012-4444

The CVE-2012-4444 issue affects the Linux kernel prior to 2.6.36, where the ip6_frag_queue function in net/ipv6/reassembly.c can be exploited remotely to bypass certain network restrictions by sending overlapping IPv6 fragments. The vulnerability is consistently described in multiple sources (Lin...

CVE-2013-0349

CVE-2013-0349 affects the Linux kernel’s HIDP path: hidp_setup_hid in net/bluetooth/hidp/core.c fails to copy a certain name field, enabling a local attacker to read sensitive kernel memory by setting an oversized name and issuing HIDPCONNADD. The issue exists in kernel versions before 3.7.6. Mit...

CVE-2013-3231

CVE-2013-3231 affects the Linux kernel prior to 3.9-rc7. The llc_ui_recvmsg function in net/llc/af_llc.c does not initialize a certain length variable, enabling local users to leak sensitive information from kernel stack memory via crafted recvmsg or recvfrom syscalls. This is a local information...

CVE-2014-0049

CVE-2014-0049 affects the Linux kernel up to version 3.13.5 via a buffer overflow in the complete_emulated_mmio path of arch/x86/kvm/x86.c. The flaw allows a guest OS user to trigger an invalid memory copy that can lead to arbitrary code execution on the host. The published fix is in Linux kernel...

CVE-2014-2038

CVE-2014-2038 affects the Linux kernel via the nfs_can_extend_write flaw in fs/nfs/write.c (before 3.13.3). The vulnerability relies on a write delegation to extend a write operation without an up‑to‑date verification, enabling local attackers to obtain sensitive kernel memory data by writing to ...

CVE-2015-8746

CVE-2015-8746 affects the Linux kernel NFS client (fs/nfs/nfs4proc.c). The root cause is that memory is not properly initialized for migration recovery operations in the NFS client, which can be exploited by remote NFS servers to trigger a denial of service via a null pointer dereference and kern...

CVE-2016-2065

The CVE-2016-2065 entry concerns the MSM QDSP6 audio driver (sound/soc/msm/qdsp6v2/msm-audio-effects-q6-v2.c) in the Linux kernel 3.x, used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices. The flaw arises from incorrect use of a parameters pointer when handling an ioctl...

CVE-2016-2853

CVE-2016-2853 – Linux kernel aufs Privilege Escalation : The vulnerability arises in the aufs module (Linux kernel 3.x/4.x) where mount namespace restrictions are insufficient. A local attacker can mount an aufs filesystem atop a FUSE filesystem and, by executing a crafted setuid program, escalat...

CVE-2016-3139

CVE-2016-3139 : The Linux kernel before 3.17 is vulnerable in drivers/input/tablet/wacom_sys.c (wacom_probe). A crafted endpoints value in a USB device descriptor can be exploited by a physically proximate attacker to trigger a NULL pointer dereference, causing a denial of service (system crash)....

CVE-2017-16996

The CVE-2017-16996 entry affects the Linux kernel (up to version 4.14.8) in kernel/bpf/verifier.c, where register truncation mishandling is the root cause. This allows local users to trigger memory corruption and potentially other impacts described as a denial of service. The vulnerability is res...

CVE-2018-12714

The CVE-2018-12714 entry concerns the Linux kernel up to 4.17.2, where filter parsing in kernel/trace/trace_events_filter.c could be invoked with no filter (N=0), causing an N−1 index access. This can lead to a slab out-of-bounds write via crafted perf_event_open and mmap, resulting in denial-of-...

CVE-2020-36779

CVE-2020-36779 affects the Linux kernel i2c stm32f7 driver. The issue is a PM reference leak where pm_runtime_get_sync increments the usage count on return even when it fails, in stm32f7_i2c_xx functions (local attack vector). The patch replaces the problematic path with pm_runtime_resume_and_get...

CVE-2021-47067

CVE-2021-47067 relates to the Linux kernel Tegra regulator code. Affected component: soc/tegra regulators in the kernel; issue was a lockup when voltage-spread is out of range. Root cause described: a bug in voltage-spread handling caused the voltage coupler to lock up; the fix accounts for the m...

CVE-2021-47071

CVE-2021-47071 in the Linux kernel affects the uio_hv_generic path. If vmbus_establish_gpadl() fails, the recv/gpadl paths are not updated, and the error-path free in hv_uio_cleanup() may not release the associated buffer, causing a memory leak. The description in the initial document confirms th...

CVE-2021-47090

CVE-2021-47090 affects the Linux kernel memory manager (mm/hwpoison) where MF_COUNT_INCREASED is not cleared before retrying get_any_page, triggering a kernel BUG in release_pages() when MADV_SOFT_OFFLINE is tested. The issue leads to a kernel panic/BUG_ON scenario (VM_BUG_ON_PAGE) during page re...

CVE-2021-47163

CVE-2021-47163 relates to the Linux kernel TIPC implementation. The issue arises when a host repeatedly loads the TIPC module, enables a UDP-based bearer, and unloads the module, causing a crash (BUG: unable to handle kernel paging request at ffffffffc096bb00) due to a work queue cleanup path. Th...

CVE-2021-47207

CVE-2021-47207 (Linux kernel) : A null pointer dereference in ALSA gus handling (snd_gf1_dma_next_block) could occur if the pointer block returned null. The issue is fixed by adding a null check before dereferencing the pointer. Impact per the entry: local attack vector, low privileges required, ...

CVE-2021-47211

CVE-2021-47211 refers to a Linux kernel vulnerability in ALSA: usb-audio where snd_usb_find_clock_source could return a null cs_desc, risking a null pointer dereference. The fix adds a null check before dereferencing the clock source descriptor. The portrait of affected code points to the ALSA us...

CVE-2021-47253

CVE-2021-47253 affects the Linux kernel’s DRM/AMD display path, where DMUB hw_init could leak memory on suspend/resume due to kzalloc allocation without guard. The fix ensures the DC wrapper memory is only allocated if it was not previously allocated, avoiding reallocation on suspend/resume. Docu...

CVE-2021-47259

CVE-2021-47259 is a Linux kernel use-after-free in NFS: nfs4_init_client. Public docs confirm KASAN-detected UAF when mounting two exports via two NICs on the same server; affected kernels include around 5.7–5.10 with the root cause linked to refcounting changes. The connected Astra/Unity/EulerOS...

CVE-2021-47335

CVE-2021-47335 (Linux kernel, f2fs) : A race on the global fsync_entry_slab across multi filesystem instances caused a use-after-free in the slab cache during f2fs recovery. The root cause is concurrent access to the slab pointer when multiple f2fs mounts exist, leading to a use-after-free during...

CVE-2021-47337

The CVE-2021-47337 issue is in the Linux kernel SCSI core path: when an error arises during scsi_host_alloc() and the error-handling ehandler thread fails to spawn, shost->ehandler may be set to ERR_PTR(-ENOMEM) and scsi_host_dev_release() would call kthread_stop() on a NULL/invalid pointer, r...

CVE-2021-47357

CVE-2021-47357 : In the Linux kernel, the atm: iphase removal path calls del_timer(), which can leave a timer handler running after the driver remove completes, causing a possible use-after-free. The fix uses del_timer_sync() to wait for the timer handler to finish and prevent rescheduling. Conne...