CVE-2024-46741

The CVE-2024-46741 issue is in the Linux kernel’s misc/fastrpc subsystem. The root cause is a double free of the fastrpc buffer in the error path of fastrpc_req_mmap(): the buffer is freed in fastrpc_req_munmap_impl() on a successful unmap, but there is an unconditional call to fastrpc_buf_free()...

CVE-2024-46862

CVE-2024-46862 relates to the Linux kernel ASoC: Intel soc-acpi-intel-mtl-match fix. The issue arises from handling an empty item in the snd_soc_acpi_link_adr array due to the absence of a links_num field in struct snd_soc_acpi_mach, which affected the end-of-loop condition in hda_sdw_machine_sel...

CVE-2024-50288

CVE-2024-50288 affects the Linux kernel vivid driver (video capture path). The issue arises in vivid_create_queue handling of video capture buffers: the video capture queue can request up to 64 buffers, but the must_blank array remained sized for 32 (VIDEO_MAX_FRAME), causing an out-of-bounds wri...

CVE-2024-51729

Technical details for CVE-2024-51729 are not provided in the connected documents. The supplied items reference a kernel fix at a high level but do not enumerate affected products/versions beyond generic kernel context; monitor for updates.

CVE-2024-56534

CVE-2024-56534 affects the Linux kernel isofs implementation. The flaw is a memory leak in iocharset handling during mount parsing; opt->iocharset may not be freed in some paths (e.g., when isofs_fill_super is bypassed, such as in get_tree_bdev_flags scenarios). The description notes that free...

CVE-2025-21807

CVE-2025-21807 (Linux kernel) affects the block subsystem. queue_attr_store() previously freezes the device queue before invoking the attribute store operation. For attributes controlling queue limits, the store could lock queue limits via queue_limits_start_update(), creating an ABBA deadlock if...

CVE-2025-21977

CVE-2025-21977 : Linux kernel hyperv_fb vulnerability affecting Gen2 Hyper‑V VMs. When the kdump kernel loads, efifb may hang due to the Hyper‑V framebuffer being moved to a new MMIO address and the kdump screen_info using the original address. Root cause: framebuffer relocation is not reset for ...

CVE-2025-21988

CVE-2025-21988 affects the Linux kernel function in the filesystem netfs: fs/netfs/read_collect.c. The issue occurs when multiple subrequests donate data to the same next request, and depending on completion order each donation overwrites the previous value in next->prev_donated. This leads to...

CVE-2025-21990

This CVE affects the Linux kernel DRM/AMDGPU path. The vulnerability arises when determining GFX12 page table entry (PTE) flags for BOs (backing stores). Specifically, PRT BOs may have no backing store, making bo->tbo.resource NULL. If this NULL is dereferenced, it can lead to a crash or other...

CVE-2025-22082

CVE-2025-22082 affects the Linux kernel IIO subsystem: iio_backend_debugfs_write_reg() could pass an uninitialized stack buffer to sscanf() due to missing NULL termination. The root cause is a stack buffer not guaranteed to be 0-initialized, leading to potential uncontrolled reads. The vulnerabil...

CVE-2025-37751

The CVE affects the Linux kernel x86 CPU code. It arises from removing the NULL terminator at the end of the AMD erratum table during the switch from x86_cpu_desc to x86_cpu_id, causing readers to read past the end of the array. The fixed behavior is to replace the NULL terminator. Connected sour...

CVE-2025-37986

CVE-2025-37986 — Linux kernel USB Type-C issue : A patch in the kernel fixes a vulnerability in the usb: typec class by invalidating/clearing USB device pointers when a Type-C partner unregisters. The change prevents use of stale pointers after a partner disconnect, ensuring a clean state for fut...

CVE-2025-38014

CVE-2025-38014 : In the Linux kernel’s dmaengine idxd subsystem, a removal path was refactored to use an idxd_cleanup() helper, which fixes code duplication and also corrects a missing put_device() for idxd groups, engines, and work queues. The vulnerability is described as a local-access issue w...

CVE-2025-38024

CVE-2025-38024 pertains to the Linux kernel RDMA/rxe path. The issue is a slab-use-after-free Read in rxe_queue_cleanup, triggered when rxe_cq_from_init fails during CQ creation and the subsequent rxe_cleanup is responsible for freeing resources. Some memory has already been freed in rxe_cq_from_...

CVE-2025-38035

CVE-2025-38035 affects the Linux kernel NVMe over Fabrics target code (nvmet-tcp). The fix prevents restoring sock->sk->sk_state_change when queue->state_change is NULL, avoiding a NULL pointer dereference in nvmet_tcp_set_queue_sock() / nvmet_tcp_set_queue_sock() call paths. Impact is a...

CVE-2025-38063

The CVE-2025-38063 entry concerns a Linux kernel vulnerability in the Linux DM (device-mapper) path where a bio submitted with REQ_PREFLUSH causes an unconditional IO throttle via wbt_wait, throttling the flush_bio that includes REQ_OP_WRITE | REQ_PREFLUSH | REQ_SYNC. The root cause is throttling...

CVE-2025-38074

CVE-2025-38074 affects the Linux kernel vhost-scsi path. The issue arises when the vhost-scsi completion path accesses vq->log_base after vq->log_used has been set to false, due to a race around vq->mutex protecting vq->log_used. The fix adds a mutex around vq->log_used checks to p...

CVE-2025-38111

The CVE-2025-38111 entry concerns the Linux kernel, specifically the MDIO bus driver (net/mdiobus). The issue arises from ioctl parameter handling that could accept MDIO addresses beyond PHY_MAX_ADDR (32), potentially enabling out-of-bounds reads/writes via mdiobus operations. The fix adds addres...

CVE-2025-38362

The CVE-2025-38362 issue is in the Linux kernel’s DRM AMD display path. The function get_first_active_display() could return NULL when the display list is empty, and mod_hdcp_hdcp1_enable_encryption() did not check this return value, risking a NULL pointer dereference in mod_hdcp_hdcp2_enable_enc...

CVE-2026-46259

In the Linux kernel procfs path do_task_stat() reading /proc/[pid]/stat, task->real_parent is accessed without proper RCU protection, enabling a potential Use-After-Free when another task is released. The fix switches from task_tgid_nr_ns() to task_ppid_nr_ns() to add proper RCU protection for...

CVE-2003-0985

CVE-2003-0985 affects Linux kernel 2.4.x (pre-2.4.21, possibly before 2.4.24). The do_mremap path lacks proper bounds checking, enabling local users to cause a denial of service and potentially gain privileges by remapping a VMA to a zero-length VMA. Connected data confirms CVE-2005-0528 is a dup...

CVE-2004-0949

CVE-2004-0949 affects the Samba filesystem smbfs in Linux kernel 2.4/2.6, where smb_recv_trans2 fails to reassemble fragmented packets, allowing a remote attacker via the network to read arbitrary kernel information or to inflate a counter by replaying the first fragment. Public advisories (RHSA,...

CVE-2006-1864

CVE-2006-1864: Directory traversal in smbfs (Linux kernel 2.6.16 and earlier) lets a local user escape chroot restrictions for an SMB-mounted filesystem via "..\" sequences. Severity: CVSS v2 base 4.6 (Medium); vectors indicate LOCAL access with low complexity and partial confidentiality/integrit...

CVE-2006-2932

CVE-2006-2932 is a regression in the restore_all code path of the 4/4GB split support for non-hugemem kernels in Red Hat Enterprise Linux 4 (Desktop/Enterprise) that allows a local user to cause a denial of service (panic) via unspecified vectors. The issue is documented in Red Hat advisories RHS...

CVE-2006-5757

CVE-2006-5757 is a local privilege vulnerability in the Linux kernel (2.6.x) related to the __find_get_block_slow function within the ISO9660 filesystem. The issue allows a local user to trigger a denial of service (infinite loop) by mounting a crafted ISO9660 image containing malformed data stru...

CVE-2006-6304

The CVE-2006-6304 issue affects Linux kernel 2.6.19 where do_coredump in fs/exec.c sets the O_EXCL flag but does not use it, enabling a context-dependent attacker to modify arbitrary files via a core-dump rewrite attack. A fix is available in the kernel changelog (2.6.19.1) and related advisories...

CVE-2007-1496

CVE-2007-1496 affects nfnetlink_log in the Linux kernel prior to 2.6.20.3. The issue is triggered via netfilter’s nfnetlink path (nfulnl_recv_config) when handling netlink messages, including cases with multiple packets per netlink message and bridged packets, leading to a NULL pointer dereferenc...

CVE-2007-3104

The vulnerability CVE-2007-3104 affects the Linux kernel 2.6 in use by RHEL 4.5 and similar distros, where sysfs_readdir can dereference a NULL inode in a dentry, causing a kernel OOPS (local access). This denial-of-service risk is described in multiple advisories, with confirmed references to th...

CVE-2008-5079

CVE-2008-5079 affects the Linux kernel ATM subsystem, specifically net/atm/svc.c in 2.6.27.8 and earlier. A local attacker can cause a denial of service (kernel infinite loop) by performing two calls to svc_listen on the same socket and then reading a /proc/net/atm/*vc file, which relates to corr...

CVE-2010-2066

CVE-2010-2066 affects the Linux kernel up to version 2.6.34. The flaw is in fs/ext4/move_extent.c: the mext_check_arguments routine, which can allow a local attacker to overwrite an append-only file when using the MOVE_EXT ioctl and designating that file as the donor. The issue arises from insuff...

CVE-2010-3079

CVE-2010-3079 affects the Linux kernel up to version 2.6.35.4, specifically in kernel/trace/ftrace.c when debugfs is enabled. The issue arises from interaction between mutex possession and llseek, causing a NULL pointer dereference and outage of all ftrace-related files, leading to a local DoS. A...

CVE-2011-0710

CVE-2011-0710 affects the Linux kernel on the s390 platform. The function task_show_regs in arch/s390/kernel/traps.c permits a local user to read the registers of an arbitrary process by reading a status file under /proc, for kernels before 2.6.38-rc4-next-20110216. The connected MiracleLinux adv...

CVE-2011-1767

CVE-2011-1767 affects the Linux kernel prior to 2.6.34, where ip_gre, if built as a module, can trigger a remote denial of service (OOPS) by processing a crafted packet during module loading in net/ipv4/ip_gre.c. Investigations in connected advisories confirm related patches exist to address GRE/...

CVE-2011-4915

CVE-2011-4915 affects the Linux kernel, specifically the file fs/proc/base.c, up to version 3.1. It enables a local attacker to disclose sensitive keystroke information by accessing /proc/interrupts, constituting an information-disclosure vulnerability. Root cause: improper exposure of keystroke-...

CVE-2011-5327

The CVE-2011-5327 issue affects the Linux kernel prior to 3.1, where an off-by-one in the function drivers/target/loopback/tcm_loop.c: tcm_loop_make_naa_tpg() can cause memory corruption. This root cause is stated across the CVE entry and related advisories, with impact described as memory corrup...

CVE-2012-0044

CVE-2012-0044 is an integer overflow in drm_mode_dirtyfb_ioctl() within Linux kernel drivers/gpu/drm/drm_crtc.c, vulnerable before 3.1.5. The flaw allows local users to gain privileges or trigger memory corruption/DoS via a crafted ioctl. Public sources (including MiracleLinux AXSA-2012-646:05) c...

CVE-2012-1179

CVE-2012-1179 affects the Linux kernel prior to 3.3.1 when KVM is used: guest OS users can trigger a host OS denial of service (host crash) via page faults related to huge pages in pmd_none_or_clear_bad. MiracleLinux and related advisories reference this CVE among fixes in kernel updates before/a...

CVE-2012-3510

CVE-2012-3510 is a Linux kernel use-after-free in xacct_add_tsk (kernel/tsacct.c) affecting versions before 2.6.19. Local users can read potentially sensitive kernel memory or trigger a denial of service via TASKSTATS_CMD_ATTR_PID. Remediation: upgrade to kernel 2.6.19 or newer (or apply backport...

CVE-2014-1690

The vulnerability CVE-2014-1690 affects the Linux kernel’s net/netfilter/nf_nat_irc.c before 3.12.8. An IRC DCC session with incorrect NAT mangle data can allow a remote attacker to read kernel memory. Impact is information disclosure; exploitation context is remote over the network. The fixed ve...

CVE-2014-2672

CVE-2014-2672 : A race condition in the Linux kernel’s ath9k driver (ath_tx_aggr_sleep in drivers/net/wireless/ath/ath9k/xmit.c) before 3.13.7 can be triggered by a high volume of network traffic, enabling remote attackers to cause a denial of service (system crash). Public sources in connected d...

CVE-2016-4951

CVE-2016-4951 refers to a vulnerability in the Linux kernel (tipc_nl_publ_dump in net/tipc/socket.c) present up to version 4.6. The function does not verify socket existence, allowing a local attacker to trigger a denial of service via a NULL pointer dereference that can crash the system, potenti...

CVE-2017-13715

The CVE-2017-13715 issue affects the Linux kernel (net/core/flow_dissector.c). The __skb_flow_dissect function can fail to initialize n_proto, ip_proto, and thoff, enabling a remote attacker to trigger a denial of service (system crash) or potentially execute arbitrary code via a crafted MPLS pac...

CVE-2017-17852

CVE-2017-17852 affects the Linux kernel’s BPF verifier (kernel/bpf/verifier.c) up to version 4.14.8. The root cause is mishandling of 32-bit ALU operations, which can allow local users to cause a denial of service (memory corruption) and possibly other impact. The connected Nessus entries repeat ...

CVE-2017-18202

The CVE-2017-18202 issue affects the Linux kernel prior to 4.14.4, where __oom_reap_task_mm in mm/oom_kill.c mishandles gather operations. This can enable a local attacker to cause a denial of service via a TLB entry leak or use-after-free, potentially with other unspecified impacts by triggering...

CVE-2017-9059

The CVE-2017-9059 vulnerability affects the Linux kernel’s NFSv4 implementation (up to version 4.11.1). The root cause is an improper channel callback shutdown during unmount of an NFSv4 filesystem, described as a module reference and kernel daemon leak. Impact stated in the sources is a local de...

CVE-2021-47168

The CVE-2021-47168 entry relates to a Linux kernel NFS vulnerability in filelayout_decode_layout where sizeof(struct nfs_fh) was two bytes too large, risking memory corruption. The issue arises from using a size that is larger than the actual buffer (->data[]), and the arguments were reversed ...

CVE-2021-47183

CVE-2021-47183 concerns the Linux kernel SCSI lpfc driver. The issue occurs during a Fibre Channel link-down transition when PLOGIs are outstanding. ABTS requests may trigger a NULL pointer dereference because Abort WQEs are issued before the link state is set to down, and abort completions can r...

CVE-2021-47265

CVE-2021-47265 is a Linux kernel RDMA issue in the mlx5_ib driver. The vulnerability stems from missing validation of the user-supplied port when creating a flow rule, leading to an improper check and a kernel oops as shown in the call trace (_create_flow_rule … mlx5_ib_create_flow …). The CVE ha...

CVE-2021-47309

CVE-2021-47309 affects the Linux kernel's net/tunnel code: skb_tunnel_info() may return a pointer to lwtstate->data without validating its type, risking out-of-bounds reads such as during VXLAN routing. Connected advisories (SUSE-SU-2024:2561-1 and related OSV/Nessus entries) confirm the fix i...

CVE-2021-47368

CVE-2021-47368 concerns a Linux kernel vulnerability in enetc where irq_set_affinity_hit() stores a cpumask_t reference in an irq descriptor, referencing memory on the stack. This leads to illegal accesses when the affinity_hint is read via procfs, potentially causing paging oops. The issue is mi...