CVE-2024-47708

CVE-2024-47708 : In the Linux kernel, the netkit driver missed assigning the required bpf_net_context during XDP-redirect handling, causing a NULL pointer dereference when NETKIT_REDIRECT invokes skb_do_redirect() and accesses per-CPU variables. The fix is to set the bpf_net_context before callin...

CVE-2024-49943

CVE-2024-49943 affects the Linux kernel DRM XE driver (guc_submit_wedged_fini). A missing locking around wedged_fini permits a use-after-free when a non-wedged queue is dereferenced concurrently with an async queue destroy. The fix is to hold the submission_state lock during the wedge-status chec...

CVE-2024-56669

CVE-2024-56669 (Linux kernel): Fix for cache tag leakage in VT-d IOMMU when disabling ATS that could cause use-after-free and kernel crash, notably with multiple VFs via vfio-pci. Root cause: cache tags were removed after ATS disable, leaving CACHE_TAG_DEVTLB entries in the domain’s list. The pat...

CVE-2024-57923

CVE-2024-57923 covers a Linux kernel issue in btrfs zlib HW compression on s390 where input length passed to zlib_compress_folios() could exceed input range due to strm.avail_in calculation becoming a multiple of PAGE_SIZE. The result is an assertion in btrfs_compress_folios() (total_in > orig...

CVE-2025-21977

CVE-2025-21977 : Linux kernel hyperv_fb vulnerability affecting Gen2 Hyper‑V VMs. When the kdump kernel loads, efifb may hang due to the Hyper‑V framebuffer being moved to a new MMIO address and the kdump screen_info using the original address. Root cause: framebuffer relocation is not reset for ...

CVE-2025-22046

CVE-2025-22046: In the Linux kernel, the uprobes/x86 uretprobe trampoline check was hardened to prevent a trampoline_check_ip path that could allow a call into the syscall from memory addresses near the bottom of the address space if uretprobes were not set up. Root cause: trampoline_check_ip cou...

CVE-2025-22082

CVE-2025-22082 affects the Linux kernel IIO subsystem: iio_backend_debugfs_write_reg() could pass an uninitialized stack buffer to sscanf() due to missing NULL termination. The root cause is a stack buffer not guaranteed to be 0-initialized, leading to potential uncontrolled reads. The vulnerabil...

CVE-2025-22100

CVE-2025-22100 corresponds to a Linux kernel race condition in the DRM Panthor driver (panthor_fdinfo_gather_group_samples). The root cause was a failure to protect group access with an xarray lock, which could lead to use-after-free. The issue is addressed by the patch in commit e16635d88fa0 (dr...

CVE-2025-22114

CVE-2025-22114 (Linux kernel, btrfs) is fixed: the patch prevents clobbering the previously set return value in btrfs_validate_super() by ensuring validate_sys_chunk_array() does not wipe the early validity checks. The root cause is that the call to validate_sys_chunk_array() could overwrite ret,...

CVE-2025-38058

CVE-2025-38058 affects the Linux kernel: the function __legitimize_mnt() in fs/namespace.c mis-handled synchronization around MNT_SYNC_UMOUNT, risking an incorrect mnt_count handling and a dropped reference to the caller after umount(2) checks but before MNT_SYNC_UMOUNT is set. The issue is resol...

CVE-2025-38074

CVE-2025-38074 affects the Linux kernel vhost-scsi path. The issue arises when the vhost-scsi completion path accesses vq->log_base after vq->log_used has been set to false, due to a race around vq->mutex protecting vq->log_used. The fix adds a mutex around vq->log_used checks to p...

CVE-2025-38107

CVE-2025-38107: In the Linux kernel, a race in net_sched:ets (ets_qdisc_change) was fixed. The race occurs when a SFQ perturb timer fires at an inopportune moment, enabling underflow of a parent qlen during qdisc operations. The corrective action is to purge the qdisc with qdisc_purge_queue() bef...

CVE-2025-38181

CVE-2025-38181 affects the CALIPSO path in the Linux kernel. The root cause is a null pointer dereference in calipso_req_setattr() when CALIPSO option handling fetches a sock via sk_to_full_sk(), which could leave reqsk->rsk_listener NULL. The issue is tied to a previous commit around SYN Cook...

CVE-2025-38204

CVE-2025-38204 affects the Linux kernel’s JFS filesystem. The issue is an array-index-out-of-bounds read in add_missing_indices, where stbl (s8) must map to offsets 0–127. A bound check was added and -EIO is returned if the check fails; jfs_readdir is also updated to propagate errors from add_mis...

CVE-2025-38283

CVE-2025-38283 is addressed in Azure Linux 3.0 kernel updates. The issue in hisi_acc_vfio_pci caused a NULL data address during live migration when no VF device driver is loaded in the guest, leading to potential access errors on the destination during device data migration. The fix ensures live ...

CVE-2025-38334

In CVE-2025-38334, the Linux kernel SGX path could reclaim EPC pages that are poisoned. Root cause: epc_page->poison is set during memory failure but the reclaimer logic does not check it, so poisoned EPC pages could be reclaimed and written out with EWB microcode operations, risking enclosure...

CVE-2025-38346

CVE-2025-38346: Linux kernel ftrace UAF when lookup kallsyms after ftrace is disabled. Root cause: use-after-free accessing mod->name during module removal when ftrace_disable is active. Impact per CVSS: Local access with Low privileges required, High confidentiality/integrity/availability imp...

CVE-2025-38362

The CVE-2025-38362 issue is in the Linux kernel’s DRM AMD display path. The function get_first_active_display() could return NULL when the display list is empty, and mod_hdcp_hdcp1_enable_encryption() did not check this return value, risking a NULL pointer dereference in mod_hdcp_hdcp2_enable_enc...

CVE-2025-38395

CVE-2025-38395 involves the Linux kernel regulator GPIO driver. The root cause is an out-of-bounds access in drvdata::gpiods because memory was allocated for only one pointer, while config::ngpios can exceed 1. The vulnerability can occur when more than one GPIO descriptor is configured. The fix ...

CVE-2025-38678

The CVE-2025-38678 vulnerability affects the Linux kernel’s netfilter nf_tables path, where a chain/flowtable update can carry duplicate devices within the same batch. The bug could leave the hook for a duplicated device unregistering, potentially enabling a foothold in local updates. The issue i...

CVE-2026-52943

CVE-2026-52943 affects the Linux kernel: two pskb_carve helpers (pskb_carve_inside_header and pskb_carve_inside_nonlinear) copy the old skb_shared_info header via memcpy without calling net_zcopy_get() for the new copy, creating an unaccounted destructor_arg (uarg) reference. This can cause use-a...

CVE-2026-64268

CVE-2026-64268 concerns a Linux kernel vulnerability in the SIW (RDMA) path where Read Response segments could overrun the sink buffer. The issue resides in siw_qp_rx.c (siw_proc_rresp) which places inbound Read Response DDP segments at sge->laddr + wqe->processed and accumulates processed ...

CVE-2004-0949

CVE-2004-0949 affects the Samba filesystem smbfs in Linux kernel 2.4/2.6, where smb_recv_trans2 fails to reassemble fragmented packets, allowing a remote attacker via the network to read arbitrary kernel information or to inflate a counter by replaying the first fragment. Public advisories (RHSA,...

CVE-2004-1335

The CVE-2004-1335 entry describes a memory leak in the Linux kernel’s ip_options_get function (pre-2.6.10) that can cause local denial of service via repeated ip_cmsg_send calls. Affected component is the kernel networking stack; impact is partial availability due to memory exhaustion. The vulner...

CVE-2006-2932

CVE-2006-2932 is a regression in the restore_all code path of the 4/4GB split support for non-hugemem kernels in Red Hat Enterprise Linux 4 (Desktop/Enterprise) that allows a local user to cause a denial of service (panic) via unspecified vectors. The issue is documented in Red Hat advisories RHS...

CVE-2007-2878

CVE-2007-2878: VFAT compat ioctl handling in 64-bit Linux kernels before 2.6.21.2 allows a local user to corrupt a kernel_dirent structure and cause a denial of service (system crash). The issue is documented across multiple advisories (RHSA/CESA, Oracle Linux, CentOS, OpenVAS) and is addressed b...

CVE-2008-2544

CVE-2008-2544 describes a local bypass where mounting the /proc filesystem inside a chroot can occur in read-write mode, allowing a user to bypass the chroot and gain write access to files they would not normally access. The connected documents reiterate the same description but do not provide pr...

CVE-2008-4576

CVE-2008-4576 affects the Linux kernel SCTP implementation prior to 2.6.25.18. A remote attacker can trigger a denial of service by sending an INIT-ACK that states the peer does not support AUTH, causing sctp_process_init to clean up active transports and, when the T1-Init timer expires, to trigg...

CVE-2008-5300

CVE-2008-5300 affects the Linux kernel (example reference in CVE-2008-5300 entry) where local users can cause a denial of service by issuing a large number of sendmsg calls; the trigger is that AF_UNIX garbage collection does not block, leading to an OOM and process loss. The connected advisories...

CVE-2009-0029

This CVE affects the Linux kernel 2.6.28 and earlier on s390, powerpc, sparc64, and mips 64-bit platforms. The root cause is that a 32-bit user-space argument in a 64‑bit register was not verifiably sign-extended when passed to a system call, allowing local users to crash the kernel or potentiall...

CVE-2009-0322

CVE-2009-0322 affects the Linux kernel Dell RBU (Remote BIOS Update) driver: reading zero bytes from image_type or packet_size under /sys/devices/platform/dell_rbu/ can cause a local DoS (system crash). Concrete references in connected advisories show affected kernels include 2.6.27.x (before 2.6...

CVE-2009-3286

CVE-2009-3286 affects the Linux kernel 2.6.18 (and possibly other versions) where NFSv4 O_EXCL creates are not properly cleaned up, causing files to be created with insecure settings (e.g., setuid bits) and potentially enabling local privilege escalation. The issue is tied to the do_open_permissi...

CVE-2009-4131

The CVE refers to EXT4_IOC_MOVE_EXT (move extents) in the Linux kernel’s ext4 filesystem, where the ioctl allows local users to overwrite arbitrary files due to insufficient permission checks. Affected: ext4 subsystem on kernel versions prior to 2.6.32-git6. Impact: local privilege-related overwr...

CVE-2010-4079

CVE-2010-4079 affects the Linux kernel ivtvfb driver (ivtvfb_ioctl in drivers/media/video/ivtv/ivtvfb.c) prior to 2.6.36-rc8. The root cause is failure to initialize a structure member, enabling local users to leak information from kernel stack memory via the FBIOGET_VBLANK ioctl. Affected versio...

CVE-2011-2495

CVE-2011-2495 affects the Linux kernel prior to 2.6.39.4. The issue is in fs/proc/base.c where access to /proc/#####/io is insufficiently restricted, allowing local users to poll a file and infer sensitive I/O statistics (e.g., length of another user’s password). The MiracleLinux advisories refer...

CVE-2011-2689

The vulnerability CVE-2011-2689 affects the Linux kernel’s gfs2_fallocate path (fs/gfs2/file.c). It occurs in versions before 3.0-rc1, where the size of a chunk allocation may not be a multiple of the filesystem block size. This can allow a local user to trigger a denial of service and system cra...

CVE-2012-4461

CVE-2012-4461 overview: The Linux kernel KVM subsystem (pre-3.6.9) on hosts using qemu userspace without XSAVE is vulnerable. A local attacker can trigger a denial of service (kernel OOPS) by calling KVM_SET_SREGS to enable the X86_CR4_OSXSAVE bit in the guest CR4, then issuing KVM_RUN. The conne...

CVE-2012-6542

The CVE-2012-6542 issue affects the Linux kernel prior to 3.6. It involves the function llc_ui_getname in net/llc/af_llc.c returning an incorrect value under certain circumstances, enabling local users to read sensitive data from kernel stack memory via an application that uses an uninitialized p...

CVE-2013-1860

CVE-2013-1860 is a heap-based buffer overflow in the Linux kernel’s wdm_in_callback (drivers/usb/class/cdc-wdm.c) present in versions prior to 3.8.4. The vulnerability allows physically proximate attackers to crash the system or potentially execute arbitrary code through a crafted cdc-wdm USB dev...

CVE-2013-1943

CVE-2013-1943 affects the KVM subsystem of the Linux kernel prior to 3.0. It arises because memory slots in a guest’s physical address space may be allocated without validating kernel addresses, enabling local users to gain privileges or read kernel memory. Affected components: arch/x86/kvm/pagin...

CVE-2013-2148

CVE-2013-2148: In Linux kernel 3.9.x, fill_event_metadata in fs/notify/fanotify/fanotify_user.c does not initialize a structure member, enabling local users to read kernel memory via a fanotify descriptor; vulnerability affects kernels up to version 3.9.4. No remediation details provided in the d...

CVE-2013-3225

CVE-2013-3225 — Linux kernel local information disclosure . Affected: Linux kernel versions prior to 3.9-rc7, specifically the rfcomm_sock_recvmsg() path in net/bluetooth/rfcomm/sock.c. Root cause: an uninitialized length variable in recvmsg/recvfrom handling leads to leakage of kernel stack memo...

CVE-2013-4511

CVE-2013-4511 concerns multiple integer overflows in the Linux kernel’s Alchemy LCD frame-buffer drivers (au1100fb_fb_mmap and au1200fb_fb_mmap). The issue allows a local attacker to craft mmap operations to create a read-write mapping of kernel memory, enabling privilege escalation. The descript...

CVE-2014-2038

CVE-2014-2038 affects the Linux kernel via the nfs_can_extend_write flaw in fs/nfs/write.c (before 3.13.3). The vulnerability relies on a write delegation to extend a write operation without an up‑to‑date verification, enabling local attackers to obtain sensitive kernel memory data by writing to ...

CVE-2015-1465

The CVE-2015-1465 issue affects the Linux kernel IPv4 code prior to 3.18.8, where the RCU grace period length is not properly considered when redirecting lookups without caching. This can allow remote attackers to cause a denial of service via a flood of packets, leading to memory consumption or ...

CVE-2015-7509

Summary (CVE-2015-7509 + related advisory) The issue affects the Linux kernel’s ext4/namei.c logic for non-journal filesystems. In kernels before 3.7.3, the ext4_orphan_del/ orphan-list handling can be bypassed by crafted filesystems, allowing physically proximate attackers to trigger a denial of...

CVE-2016-2854

CVE-2016-2854 concerns the AUFS module in the Linux kernel (versions 3.x/4.x), which does not properly maintain POSIX ACL xattr data. This can allow a local attacker to gain privileges by exploiting a group-writable setgid directory. The connected documents confirm the vulnerability and its local...

CVE-2017-9985

CVE-2017-9985 is a local double-fetch vulnerability in the Linux kernel (snd_msndmidi_input_read in sound/isa/msnd/msnd_midi.c) affecting up to version 4.11.7. Exploitation can cause denial of service (over-boundary access) with potential unspecified impact. Public references in Nessus/OpenVAS/U-...

CVE-2019-16230

CVE-2019-16230 in Linux kernel 5.2.14 (drivers/gpu/drm/radeon/radeon_display.c) does not check the return value of alloc_workqueue, enabling a NULL pointer dereference during device initialization (boot). Unity Linux 20.1070e and Unity UTSA-2026 advisories reproduce this issue for kernel 5.2.14; ...

CVE-2020-36387

CVE-2020-36387 affects the Linux kernel up to version 5.8.2, where a use-after-free exists in fs/io_uring.c related to io_async_task_func and ctx reference holding (CID-6d816e088c35). Multiple connected advisories reference Linux kernels before 5.8.2 and indicate that patch/update to 5.8.2 or lat...