CVE-2024-38546

CVE-2024-38546 : Linux kernel (drm: vc4) fix for a NULL pointer dereference in vc4_hdmi_audio_init. of_get_address() may return NULL and be dereferenced; patch adds a NULL check to prevent the crash. This applies to the vc4 HDMI audio path in the kernel DRM vc4 driver; no exploits/public advisori...

CVE-2024-38607

CVE-2024-38607 corresponds to a Linux kernel issue: the via-macii ADB driver called request_irq() after disabling hard interrupts, which was unnecessary because the VIA shift register interrupt was masked during VIA1 initialization. The vulnerability is tied to the macintosh/via-macii driver and ...

CVE-2024-43845

CVE-2024-43845 concerns the Linux kernel udf implementation. The documented issue is a bogus checksum computation in udf_rename(), triggered when updating the checksum of the '..' directory entry in a moved directory. Syzbot noted an uninitialized memory access because on-stack diriter.fi is pass...

CVE-2024-45013

CVE-2024-45013 - Linux kernel NVMe keep-alive handling : The vulnerability stemmed from not stopping the NVMe keep-alive when unloading the host driver, creating a use-after-free path if controller startup fails. The fix moves the stopping keep-alive step into nvme_uninit_ctrl(), aligning it with...

CVE-2024-46687

CVE-2024-46687 affects the Linux kernel in the btrfs subsystem, specifically a use-after-free inside btrfs_submit_chunk() that can occur during error handling of I/O (btrfs_bio_end_io path). The documented chain shows a double-free scenario: btrfs_submit_chunk() detects a fatal error, btrfs_bio_e...

CVE-2024-49990

CVE-2024-49990 is described in the initial document as a Linux kernel issue in drm/xe/hdcp where xe_gsc could be null when performing an HDCP capability check. The vulnerability was addressed by adding a GSC structure validity check to avoid a NULL pointer dereference. The Nessus plugin UNPATCHED...

CVE-2024-50122

CVE-2024-50122 is a Linux kernel vulnerability in the PCI subsystem (power control code) where a race between the power-control device rescanning and host controller probe can leave two incomplete devices and trigger a crash when removing the device via sysfs. The root cause is not fully detailed...

CVE-2024-52319

CVE-2024-52319 — Linux kernel memory corruption/ information disclosure risk due to mm: use aligned address in clear_gigantic_page(). In current kernel, hugetlb_no_page() may call clear_gigantic_page() with a fault address that is not aligned to the huge page size, leading to potential memory cor...

CVE-2024-53192

The CVE relates to the Linux kernel’s loongson2 clock driver (clk-loongson2). The probe path allocates an array hws via devm_kzalloc() using clks_num elements, but clp->clk_data.num could exceed clks_num, risking an overflow when populating clk_hw_onecell_data.hws. The fix sets clp->clk_dat...

CVE-2025-21801

CVE-2025-21801 : In the Linux kernel ravb (Renesas Ethernet) driver, the suspend/resume path fixes a missing rtnl lock that could allow conflicts with ongoing ndo operations. The issue is mitigated by ensuring the rtnl lock is held where required (e.g., ravb_open, ravb_close, and wol operations) ...

CVE-2025-22051

CVE-2025-22051 affects the Linux kernel staging gpib driver. The issue arises when an Agilent USB dongle is disconnected, causing a NULL pointer Oops on subsequent driver calls because bus_interface is set to NULL on disconnect. The root cause is that usb_dev was being assigned from the bus_inter...

CVE-2025-22112

CVE-2025-22112 affects the Linux kernel bnxt ethernet driver. The vulnerability arises from out-of-range access to the vnic_info array in bnxt_queue_start/stop where bp->nr_vnics is exceeded, allowing access to bp->vnic_info[bp->nr_vnics]. The issue is fixed in the publicly released comm...

CVE-2025-38009

CVE-2025-38009 : In the Linux kernel, the wifi driver mt76 initializes and cleans up TX NAPI on removal. A fix disables TX NAPI before deleting the NAPI instance in mt76_dma_cleanup() to prevent a warning observed after commit 9dd05df8403b. The issue arises when driving removal of mt7921e/mt76 dr...

CVE-2025-38072

CVE-2025-38072 affects the Linux kernel in the libnvdimm/labels component. A faulty CXL memory device can report a zero LSA size, causing config_size to be zero and leading to max_xfer being zero. This triggers a division by zero in the nd_label_data_init/label handling flow (divide error in libn...

CVE-2025-38181

CVE-2025-38181 affects the CALIPSO path in the Linux kernel. The root cause is a null pointer dereference in calipso_req_setattr() when CALIPSO option handling fetches a sock via sk_to_full_sk(), which could leave reqsk->rsk_listener NULL. The issue is tied to a previous commit around SYN Cook...

CVE-2025-38192

CVE-2025-38192 is a Linux kernel vulnerability where an ingress NAT46 BPF program that flips IPv4/IPv6 can mutate skb->protocol to v6 while the dst remains IPv4, leading to a NULL pointer dereference in ip6_rcv_core. The fix is to clear the destination (dst) in all BPF helpers that change skb-...

CVE-2025-38250

In CVE-2025-38250, the Linux kernel Bluetooth vhci_flush() path is affected by a use-after-free when a thread closes a vhci fd while another thread uses the device. The issue stems from a missing synchronization after unlinking hdev from hci_dev_list in hci_unregister_dev(), allowing another thre...

CVE-2025-38283

CVE-2025-38283 is addressed in Azure Linux 3.0 kernel updates. The issue in hisi_acc_vfio_pci caused a NULL data address during live migration when no VF device driver is loaded in the guest, leading to potential access errors on the destination during device data migration. The fix ensures live ...

CVE-2026-46323

CVE-2026-46323 affects the Linux kernel’s networking GRO path. The issue occurs in skb_gro_receive() where fragments can be copied between the source and GRO skbs without respecting zerocopy status, notably when SKBFL_MANAGED_FRAG_REFS is set. When this flag is present, pages in shinfo->frags ...

CVE-2005-2458

CVE-2005-2458 affects the Linux kernel where inflate.c in the zlib routines used by the kernel before 2.6.12.5 can be exploited by remote attackers to crash the kernel via a crafted compressed file (improper tables). The connected advisories confirm this vulnerability across multiple distribution...

CVE-2007-3740

CVE-2007-3740 describes a flaw in the CIFS filesystem of the Linux kernel prior to 2.6.22 where Unix extension support can fail to honor the process umask, enabling a local user to gain privileges. Affected are kernels with CIFS Unix extensions enabled; impact is local privilege escalation. Remed...

CVE-2007-3848

CVE-2007-3848 affects the Linux kernel (notably 2.4.35 and other versions) by allowing a local user to send arbitrary signals to a higher-privilege child process via a setuid-root parent dying and delivering an attacker-controlled death signal (PR_SET_PDEATHSIG). The issue is listed in advisories...

CVE-2009-1961

CVE-2009-1961 is a local-denial-of-service vulnerability in the Linux kernel related to the inode double-locking path in fs/ocfs2/file.c. A sequence of splice system calls can deadlock between generic_file_splice_write, splice_from_pipe, and ocfs2_file_splice_write, preventing file creation/remov...

CVE-2010-1083

CVE-2010-1083 affects the Linux kernel 2.6.x up to 2.6.32 (and possibly similar versions); the processcompl_compat path in drivers/usb/core/devio.c fails to clear the transfer buffer before returning to userspace when a USB command fails, enabling potential information leakage of kernel memory to...

CVE-2010-4161

CVE-2010-4161 affects the Linux kernel 2.6.18 build used by Red Hat Enterprise Linux 5. The issue lies in udp_queue_rcv_skb in net/ipv4/udp.c, where a crafted socket filter and UDP traffic can trigger a denial of service (deadlock/system hang). The related CVE-2010-4158 is referenced. Connected d...

CVE-2010-4529

CVE-2010-4529 refers to an integer underflow in the irda_getsockopt function (net/irda/af_irda.c) of the Linux kernel prior to 2.6.37 on non-x86 platforms. This underflow could allow a local attacker to obtain potentially sensitive information from kernel heap memory via an IRLMP_ENUMDEVICES gets...

CVE-2010-4565

CVE-2010-4565 affects the Linux kernel CAN implementation (bcm_connect in net/can/bcm.c) on 2.6.36 and earlier, where a publicly accessible file is created with a filename containing a kernel memory address. This filename exposure can allow local attackers to glean potentially sensitive informati...

CVE-2012-6647

The CVE-2012-6647 issue affects the Linux kernel futex_wait_requeue_pi implementation in kernel/futex.c, vulnerable in versions before 3.5.1. The flaw allows a local attacker to cause a denial of service via a crafted FUTEX_WAIT_REQUEUE_PI command resulting in a NULL pointer dereference and syste...

CVE-2013-4270

CVE-2013-4270 affects the Linux kernel: the net_ctl_permissions function in net/sysctl_net.c may misdetermine uid/gid, allowing a local user to bypass /proc/sys/net restrictions. Affected: kernels before 3.11.5 (reported in EulerOS advisories and Nessus/OpenVAS listings). Impact is local privileg...

CVE-2013-4591

CVE-2013-4591 is a Linux kernel vulnerability affecting the nfs4 ACL path: a buffer overflow in __nfs4_get_acl_uncached within fs/nfs/nfs4proc.c, fixed in kernel 3.7.2. Versions before 3.7.2 are vulnerable to local memory corruption leading to denial of service (memory corruption and system crash...

CVE-2013-7267

CVE-2013-7267 (Linux kernel) : Affected component is the atalk_recvmsg function in net/appletalk/ddp.c, vulnerable before 3.12.4. The bug updates a length value without ensuring the associated data structure is initialized, enabling local attackers to leak kernel memory via recvfrom, recvmmsg, or...

CVE-2014-3186

CVE-2014-3186 : A buffer overflow in the PicoLCD HID device driver’s picoLCD_raw_event (Linux kernel driver, hid-picolcd_core.c) up to kernel 3.16.3 allows physically proximate attackers to crash the system or potentially execute arbitrary code by sending a crafted large HID report, as used in An...

CVE-2016-10723

CVE-2016-10723 affects the Linux kernel up to version 4.17.2. The issue is in the page allocator: it does not yield CPU resources to the owner of the oom_lock mutex, allowing a local unprivileged user to trap the system in a busy loop by wasting CPU time during oom-killer invocation. The root cau...

CVE-2016-2070

CVE-2016-2070 affects Linux kernels prior to 4.3.5. The tcp_cwnd_reduction function in net/ipv4/tcp_input.c can be triggered by crafted TCP traffic to cause a divide-by-zero DoS and system crash. According to connected advisories, upgrading to kernel 4.3.5 (as cited in ChangeLog-4.3.5) is the rem...

CVE-2017-17052

The CVE-2017-17052 entry affects the Linux kernel: the mm_init function in kernel/fork.c fails to clear the ->exe_file field of a new process’s mm_struct. This can enable a local attacker to trigger a use-after-free (and potential additional impact) by running a crafted program. Affected path ...

CVE-2017-9985

CVE-2017-9985 is a local double-fetch vulnerability in the Linux kernel (snd_msndmidi_input_read in sound/isa/msnd/msnd_midi.c) affecting up to version 4.11.7. Exploitation can cause denial of service (over-boundary access) with potential unspecified impact. Public references in Nessus/OpenVAS/U-...

CVE-2018-14615

CVE-2018-14615 concerns a buffer overflow in the Linux kernel up to version 4.17.10, triggered in truncate_inline_inode() within fs/f2fs/inline.c when unmounting an f2fs image because a length value may be negative. The connected Nessus entries repeat the same description and tie the issue to the...

CVE-2018-7754

CVE-2018-7754 affects the Linux kernel via aoedisk_debugfs_show in drivers/block/aoe/aoeblk.c. The function can be triggered by reading a debugfs file, allowing local users to obtain sensitive address information (ffree: lines). The issue is described as exploitable locally with kernel up to 4.16...

CVE-2019-18680

Mode C: Affected software is Linux kernel 4.4.x (before 4.4.195). The vulnerability is a NULL pointer dereference in rds_tcp_kill_sock() inside net/rds/tcp.c, which leads to denial of service. Mitigation/workaround: apply the patch from Linux stable 4.4.195 (ChangeLog-4.4.195) or update to a fixe...

CVE-2021-47095

CVE-2021-47095 affects the Linux kernel’s ipmi_ssif (ssif) driver. The root cause was dereferencing ssif_info->client in an error path before it was guaranteed to be set, leading to a NULL pointer dereference and a kernel crash. The fix initializes ssif_info->client before any error path ca...

CVE-2021-47217

The CVE-2021-47217 issue is in the Linux kernel's x86/hyperv code: a NULL dereference in set_hv_tscchange_cb() if Hyper-V setup fails. The vulnerability occurs when hv_vp_index is dereferenced without validating its array, causing a kernel NULL pointer dereference and potentially disabling Hyper-...

CVE-2021-47253

CVE-2021-47253 affects the Linux kernel’s DRM/AMD display path, where DMUB hw_init could leak memory on suspend/resume due to kzalloc allocation without guard. The fix ensures the DC wrapper memory is only allocated if it was not previously allocated, avoiding reallocation on suspend/resume. Docu...

CVE-2021-47254

In CVE-2021-47254, the Linux kernel gfs2 subsystem has a use-after-free in gfs2_glock_shrink_scan. The GLF_LRU flag is checked under lru_lock to remove the glock from the lru list in __gfs2_glock_put(), but cond_resched_lock(&lru_lock) allows progress on the put side without deleting the glock fr...

CVE-2021-47431

The CVE affects the Linux kernel DRM AMDGPU: gart.bo pin_count leak due to gmc_v{9,10}_0_gart_disable() not being paired with gart_enable in SR-IOV. A fix has been applied in the kernel; impact is pin_count leak on driver unload. Dereferenced details are taken from connected advisories (Unity Lin...

CVE-2021-47442

The CVE-2021-47442 issue affects the Linux kernel NFC digital path. The vulnerability arises because skb is allocated in digital_in_send_sdd_req() but is not freed when digital_in_send_cmd() fails, leading to a memory leak. The fix is to free skb if digital_in_send_cmd() returns a failure. Report...

CVE-2021-47452

CVE-2021-47452: In the Linux kernel, nf_tables netdev event handling during net namespace removal could lead to a redundant UNREGISTER notifier action because the base hook was removed too late. The issue is a sequence/order problem in the notifier vs .pre_exit hook, which could cause an attempt ...

CVE-2021-47506

CVE-2021-47506 : Linux kernel NFS delegation race in nfsd fixed to address a use-after-free via del_recall_lru when a delegation could be freed after vfs_setlease and callback processing. Symptoms include use-after-free and list corruption in laundromat threads. Connected sources (Astra Linux adv...

CVE-2021-47509

CVE-2021-47509 affects the Linux kernel ALSA: pcm: oss, where the period size could be exhaustively allocated due to an overly large 31-bit limit. The fix sets a practical period-size limit of 16 MB to prevent memory exhaustion from temporary OSS buffers. This remediation is reflected in multiple...

CVE-2021-47537

CVE-2021-47537 affects the Linux kernel in the octeontx2-af component, where in rvu_mbox_init() the mbox_regions pointer could be leaked on the switch-default path. The bug was a memory leak due to not freeing or returning the regions, and it is fixed by replacing a plain return err with a goto f...

CVE-2021-47619

CVE-2021-47619 concerns the i40e Linux kernel XDP path. A PF queue pile fragmentation caused by placing a flow director VSI immediately after the main VSI could prevent the main VSI from resizing its queue allocation when XDP is enabled on systems with many CPUs and an X722 NIC, leading to a NULL...