CVE-2025-38346

CVE-2025-38346: Linux kernel ftrace UAF when lookup kallsyms after ftrace is disabled. Root cause: use-after-free accessing mod->name during module removal when ftrace_disable is active. Impact per CVSS: Local access with Low privileges required, High confidentiality/integrity/availability imp...

CVE-2025-22110

Summary: CVE-2025-22110 affects the Linux kernel’s netfilter nfnetlink_queue component. The root cause is use of an uninitialized context variable (ctx/lsmctx) in nfqnl_build_packet_message(), which could be used before safe initialization; the patch initializes the lsmctx to a safe value at decl...

CVE-2025-37869

CVE-2025-37869 : Linux kernel fix for drm/xe: Use local fence in error path of xe_migrate_clear. The error path previously waited on m->fence (potential UAF) and was only stable under the job mutex. The patch changes to wait on the local fence to prevent the use-after-free. (Cherry-picked from...

CVE-2025-37934

CVE-2025-37934 affects the Linux kernel’s ASoC simple-card-utils, specifically the graph_util_parse_link_direction pointer checks. The issue arises from writing to potentially-invalid pointers when playback_only is absent, causing UBSAN invalid-load warnings (example in imx-card.c). The vulnerabi...

CVE-2025-37966

CVE-2025-37966 affects the Linux kernel (RISC‑V) where a PR_SET_TAGGED_ADDR_CTRL path crashes if the Supm extension is unavailable. The fixed version checks Supm availability to prevent Oops, addressing a LOCAL, LOW‑complexity issue with HIGH availability impact per the provided metrics.

CVE-2025-38009

CVE-2025-38009 : In the Linux kernel, the wifi driver mt76 initializes and cleans up TX NAPI on removal. A fix disables TX NAPI before deleting the NAPI instance in mt76_dma_cleanup() to prevent a warning observed after commit 9dd05df8403b. The issue arises when driving removal of mt7921e/mt76 dr...

CVE-2025-38035

CVE-2025-38035 affects the Linux kernel NVMe over Fabrics target code (nvmet-tcp). The fix prevents restoring sock->sk->sk_state_change when queue->state_change is NULL, avoiding a NULL pointer dereference in nvmet_tcp_set_queue_sock() / nvmet_tcp_set_queue_sock() call paths. Impact is a...

CVE-2025-38075

CVE-2025-38075 affects the Linux kernel iscsi target/scsi subsystem. A NOPIN response timer could be restarted on expiration for a deleted connection, causing a NULL pointer dereference and a crash in iscsit_fill_cxn_timeout_err_stats during timeout handling. The root cause is the nopin timer bei...

CVE-2025-38146

The CVE CVE-2025-38146 concerns the Linux kernel net/openvswitch MPLS parsing dead loop when handling MPLS stacks, where the label count may wrap and an invalid index (-1) can occur in key_extract_l3l4, causing a potential soft lockup/CPU stall. Affected: Linux kernel with openvswitch MPLS flow p...

CVE-2025-38159

CVE-2025-38159: Linux kernel wifi/rtw88 fix to prevent out-of-bounds read by enlarging the para buffer from 2 to 6 bytes, since code reads data[0]..data[4] in rtw_fw_bt_wifi_control. Affected component is the kernel’s wifi driver, with Svace-detected reading that could access 5 bytes. Patch/mitig...

CVE-2025-38338

CVE-2025-38338 is a Linux kernel vulnerability affecting NFS read paths. A double-unlock in fs/nfs/read during truncation can cause a deadlock because folio_unlock() may be called twice, incorrectly clearing the PG_locked flag. This can lead to warnings in netfs_read_collection or to processes wa...

CVE-2025-38395

CVE-2025-38395 involves the Linux kernel regulator GPIO driver. The root cause is an out-of-bounds access in drvdata::gpiods because memory was allocated for only one pointer, while config::ngpios can exceed 1. The vulnerability can occur when more than one GPIO descriptor is configured. The fix ...

CVE-2025-38399

CVE-2025-38399 describes a NULL pointer dereference in the Linux kernel SCSI target code. Specifically, core_scsi3_decode_spec_i_port() may call core_scsi3_lunacl_undepend_item() with dest_se_deve, which could be NULL in an error path, potentially leading to a kernel crash. The fix implemented ad...

CVE-2025-38401

The CVE-2025-38401 issue affects the Linux kernel’s mtk-sd driver, where a DMA map failure in msdc_prepare_data() could lead to memory corruption if data DMA is started with stale settings. The vulnerability’s description and related advisories (including Debian LTS DLA entries and Amazon Linux A...

CVE-2025-39766

CVE-2025-39766 : In the Linux kernel, the net/sched cake_enqueue path was fixed to return NET_XMIT_CN when dropping packets due to a very small buffer_limit, preventing htb_enqueue from activating an empty child qdisc. The issue caused packet drops to be signaled as NET_XMIT_SUCCESS, leading to f...

CVE-2007-4567

CVE-2007-4567 affects the Linux kernel (ipv6_hop_jumbo in net/ipv6/exthdrs.c). The vulnerability arises from improper validation of the hop-by-hop IPv6 extended header, enabling remote attackers to trigger a denial of service via a crafted IPv6 packet that can cause a NULL pointer dereference and...

CVE-2008-3915

CVE-2008-3915 is a buffer overflow in the Linux kernel’s nfsd when NFSv4 is enabled. The issue can allow remote triggering of a denial of service via crafted NFSv4 ACL decoding; affected are kernels older than 2.6.26.4. The Debian/Ubuntu advisories in the connected set reference this CVE among a ...

CVE-2009-0029

This CVE affects the Linux kernel 2.6.28 and earlier on s390, powerpc, sparc64, and mips 64-bit platforms. The root cause is that a 32-bit user-space argument in a 64‑bit register was not verifiably sign-extended when passed to a system call, allowing local users to crash the kernel or potentiall...

CVE-2009-0322

CVE-2009-0322 affects the Linux kernel Dell RBU (Remote BIOS Update) driver: reading zero bytes from image_type or packet_size under /sys/devices/platform/dell_rbu/ can cause a local DoS (system crash). Concrete references in connected advisories show affected kernels include 2.6.27.x (before 2.6...

CVE-2009-0778

CVE-2009-0778 affects the Linux kernel prior to 2.6.25 when configured as a router with a REJECT route. The icmp_send code in net/ipv4/icmp.c can mishandle the Protocol Independent Destination (DST) cache, potentially leaking DST state and allowing remote attackers to cause a denial of service (c...

CVE-2011-1573

CVE-2011-1573: Linux kernel SCTP (net/sctp/sm_make_chunk.c) can OOPs DoS when addip_enable and auth_enable are used because INIT/INIT-ACK length calculation ignores zero padding. Affects kernels before 2.6.34; patch/fix shipped in 2.6.34+. vulnerable component/file: sm_make_chunk.c; impact: denia...

CVE-2011-1771

CVE-2011-1771 affects the Linux kernel up to version 2.6.38, specifically the cifs_close function in fs/cifs/file.c. If a local user opens a CIFS file with the O_DIRECT flag, it can trigger a NULL pointer dereference (and BUG), causing a denial of service or unspecified impact. Mitigation: upgrad...

CVE-2012-0045

CVE-2012-0045 relates to the Linux kernel KVM 32-bit syscall emulation. A flaw in arch/x86/kvm/emulate.c where the 0f05 (syscall) opcode is not handled correctly allows a user in a 32-bit guest to crash the guest OS (denial of service). Public references in the provided connected documents confir...

CVE-2012-2390

CVE-2012-2390 concerns a memory leak in mm/hugetlb.c of the Linux kernel up to version 3.4.2. The issue allows local users to trigger memory exhaustion or a system crash via invalid MAP_HUGETLB mmap operations. The connected Nessus advisories (UNITY_LINUX_UTSA and MIRACLE_LINUX AXSA entries) reit...

CVE-2012-4565

CVE-2012-4565 affects the Linux kernel up to version 3.4.18 (pre-3.4.19) in tcp_illinois_info within net/ipv4/tcp_illinois.c. When net.ipv4.tcp_congestion_control illinois is enabled, local users can trigger a divide-by-zero OOPS by reading TCP stats, causing denial of service. Mitigation is to u...

CVE-2013-2148

CVE-2013-2148: In Linux kernel 3.9.x, fill_event_metadata in fs/notify/fanotify/fanotify_user.c does not initialize a structure member, enabling local users to read kernel memory via a fanotify descriptor; vulnerability affects kernels up to version 3.9.4. No remediation details provided in the d...

CVE-2013-2634

CVE-2013-2634 affects the Linux kernel prior to 3.8.4. The issue: net/dcb/dcbnl.c does not initialize certain structures, enabling a local attacker to read sensitive data from kernel stack memory via a crafted application. Connected advisories (e.g., MiracleLinux AXSA-2013-592:07) corroborate the...

CVE-2014-9428

CVE-2014-9428 affects the Linux kernel’s B.A.T.M.A.N. fragmentation code (batadv_frag_merge_packets in net/batman-adv/fragmentation.c) up to version 3.18.1, where an incorrect length field in a memory calculation can be exploited by remote attackers to cause a denial of service (mesh-node system ...

CVE-2015-3332

CVE-2015-3332 affects the Linux kernel TCP Fast Open code before 3.18, where a count is not correctly maintained, allowing a local user to crash the system (DoS) via the Fast Open feature. Demonstrated on certain 3.10.x–3.16.x kernels by visiting chrome://flags/#enable-tcp-fast-open. The issue is...

CVE-2015-6526

CVE-2015-6526 affects the Linux kernel on ppc64 where perf_callchain_user_64 can enter an infinite loop due to a deep 64-bit userspace backtrace. The evidence points to Linux kernel versions before 4.0.2 (fixed in 4.0.2) and local DoS via a crafted backtrace. Affected component: arch/powerpc/perf...

CVE-2016-4558

CVE-2016-4558 : The Linux kernel BPF subsystem before 4.5.5 mishandles reference counts, enabling a local attacker to trigger a denial-of-service via use-after-free, with possible other impact on systems with large memory (32 GB+ and 1 TB mentioned in the advisory). The Nessus/NVD documents confi...

CVE-2018-12931

CVE-2018-12931 affects the Linux kernel ntfs.ko (ntfs_attr_find) in kernel 4.15.0, enabling a stack-based out-of-bounds write that can cause a denial of service (kernel oops/panic) or other unspecified impact via a crafted NTFS filesystem. The vulnerability is confirmed in multiple advisories (e....

CVE-2019-18812

CVE-2019-18812 corresponds to a memory-leak vulnerability in the Linux kernel’s sof_dfsentry_write() (sound/soc/sof/debug.c). The issue, present in kernel builds up to 5.3.9, can be exploited to cause a denial of service via memory consumption. The connected Nessus advisories (Unity Linux UTSA-20...

CVE-2020-36387

CVE-2020-36387 affects the Linux kernel up to version 5.8.2, where a use-after-free exists in fs/io_uring.c related to io_async_task_func and ctx reference holding (CID-6d816e088c35). Multiple connected advisories reference Linux kernels before 5.8.2 and indicate that patch/update to 5.8.2 or lat...

CVE-2021-47020

CVE-2021-47020 is a Linux kernel vulnerability in the SoundWire subsystem. The issue is a memory leak in the stream config error path for soundwire: stream: when stream config fails, the master runtime releases slave_runtimes from the slave_rt_list but the slave runtime is not added to that list ...

CVE-2021-47163

CVE-2021-47163 relates to the Linux kernel TIPC implementation. The issue arises when a host repeatedly loads the TIPC module, enables a UDP-based bearer, and unloads the module, causing a crash (BUG: unable to handle kernel paging request at ffffffffc096bb00) due to a work queue cleanup path. Th...

CVE-2021-47167

CVE-2021-47167 is a Linux kernel issue affecting NFS: an Oopsable condition in __nfs_pageio_add_request() could occur. The patch ensures that nfs_pageio_error_cleanup() resets the mirror array contents so the structure reflects an empty state, and it makes nfs_pageio_do_add_request() more robust ...

CVE-2021-47183

CVE-2021-47183 concerns the Linux kernel SCSI lpfc driver. The issue occurs during a Fibre Channel link-down transition when PLOGIs are outstanding. ABTS requests may trigger a NULL pointer dereference because Abort WQEs are issued before the link state is set to down, and abort completions can r...

CVE-2021-47250

CVE-2021-47250: memory leak in Linux kernel netlbl_cipsov4_add_std. The memory for doi_def->map.std allocated in netlbl_cipsov4_add_std is not freed anywhere; it should be freed in cipso_v4_doi_free, which frees the cipso DOI resource. This vulnerability detail is consistently described in con...

CVE-2021-47281

CVE-2021-47281 affects the Linux kernel ALSA seq subsystem: snd_seq_timer_open() has a race on timeri allocation per queue, allowing a later concurrent call to override the timer and cause a use-after-free until the queue closes. The vulnerability is caused by missing protection when checking the...

CVE-2021-47307

CVE-2021-47307 affects the Linux kernel CIFS implementation. The issue is a NULL dereference in cifs_compose_mount_options() when the optional ref parameter contains a NULL node_name. The vulnerability was fixed in the Linux kernel (details in the cited commits). CVSS data in the document set sho...

CVE-2021-47380

The CVE-2021-47380 issue affects the Linux kernel's HID AMD SFH driver. The vulnerability arises from a potential NULL pointer dereference when devm_add_action_or_reset() is invoked during registration, because the related data isn’t initialized yet. The provided patches move data initialization ...

CVE-2021-47475

CVE-2021-47475 is a Linux kernel vulnerability in the comedi vmk80xx USB driver. The issue arises from transfer-buffer size checks: buffers were endpoint-sized and lacked validation, enabling overflows when a malicious device with larger max-packet sizes or unexpected accesses could write past th...

CVE-2021-47478

CVE-2021-47478 – isofs in the Linux kernel : The vulnerability arises when reading inodes from a corrupted isofs image, allowing an out-of-bounds read beyond the end of the buffer. The root cause is insufficient sanity checks on the directory entry length, which could be exploited during isofs_re...

CVE-2021-47551

CVE-2021-47551 affects the Linux kernel’s DRM/AMD AMDKFD during SR-IOV reset handling. The issue could trigger a kernel panic when a reset is retried after a failed reset, due to uninitialized state being re-done. The fixed behavior avoids re-uninitialization on a subsequent reset, addressing a s...

CVE-2021-47565

The CVE-2021-47565 issue is in the Linux kernel, specifically the scsi: mpt3sas path. The root cause is a race/NULL-check problem when iterating over a host (shost) sdev list: a drive may be removed and its sas_target object freed while its sdev remains, allowing code to access sas_target->sas...

CVE-2021-47642

CVE-2021-47642: in the Linux kernel’s video fbdev/nvidiafb path, a fixed-size buffer overrun could occur by copying a channel name with strcpy into chan->adapter.name. The defect arises from copying into a 48-char buffer without length checks; fix is to use strscpy() to prevent overflows. The ...

CVE-2021-47648

CVE-2021-47648 is a Linux kernel issue where a memory leak could occur in the gpu: host1x path, specifically in host1x_remove(). The fix adds a missing host1x_channel_list_free() call in the remove path (consistent with error path handling in probe). Connected advisories confirm this memory-leak ...

CVE-2022-48652

CVE-2022-48652 affects the Linux kernel ice driver. The vulnerability arises when updating Traffic Classes (TCs) to more queues than allocated, or vice versa, which can leave stale values in num_txq/num_rq and tc_cfg in a VSI and lead to invalid pointer access. The provided diagnostics show a cra...

CVE-2022-48711

The CVE pertains to the Linux kernel TIPC protocol. The issue is in tipc_mon_rcv(), which processes domain_record structures and could overflow the kernel stack if the number of domain members exceeds MAX_MON_DOMAIN. To mitigate, the patch adds a sanity check in tipc_link_proto_rcv() to ensure th...