CVE-2018-16871

A CVE-2018-16871 issue exists in the Linux kernel’s NFS implementation (all 3.x and 4.x up to 4.20). A attacker mounting an exported NFS filesystem can trigger a null pointer dereference using an invalid NFS sequence, causing a kernel panic and denying access to the NFS server; outstanding disk w...

CVE-2021-29155

CVE-2021-29155 is a Linux kernel issue affecting the eBPF verifier path (kernel/bpf/verifier.c) that allows speculative-out-of-bounds memory accesses to leak kernel memory via side-channels. The description from connected documents ties the vulnerability to Spectre mitigations and notes that a lo...

CVE-2021-4453

The CVE-2021-4453 issue in the Linux kernel affects the drm/amd/pm path where gpu_metrics_table memory is leaked: memory allocated in renoir_init_smc_tables() is not freed in smu_v12_0_fini_smc_tables(). The provided documents describe the leak and the fix as freeing gpu_metrics_table, with no ex...

CVE-2020-25285

CVE-2020-25285 is a race condition in the Linux kernel hugetlb sysctl handlers (mm/hugetlb.c) that could allow a local attacker to corrupt memory or trigger NULL pointer dereferences. Public docs (e.g., ChangeLog-5.8.8) indicate the fix was released in kernel 5.8.8; Ubuntu/Debian advisories refer...

CVE-2020-27171

The vulnerability CVE-2020-27171 affects Linux kernels before 5.11.8. The issue is in kernel/bpf/verifier.c, where an off-by-one error enables integer underflow that can trigger out-of-bounds speculation in pointer arithmetic, allowing side-channel leakage of kernel memory and defeating Spectre m...

CVE-2018-20836

CVE-2018-20836 : A race condition in the Linux kernel before 4.20, specifically in drivers/scsi/libsas/sas_expander.c (smp_task_timedout() vs smp_task_done()), can lead to a use-after-free. Affected: Linux kernel versions prior to 4.20. Impact is described as high by CVSS. The provided documents ...

CVE-2022-0322

The CVE-2022-0322 entry concerns a flaw in the Linux kernel SCTP implementation. Specifically, in net/sctp/sm_make_chunk.c, the function sctp_make_strreset_req can trigger a BUG_ON when an operation uses more buffer than allocated, enabling local privilege access to cause a denial of service. Con...

CVE-2023-3611

Consolidated details confirm CVE-2023-3611 affects the Linux kernel’s net/sched sch_qfq code. The vulnerability is an out-of-bounds write in qfq_change_agg where lmax is updated based on packet sizes without proper bounds checks, enabling local privilege escalation. The issue is triggered in sch_...

CVE-2019-13648

CVE-2019-13648 affects the Linux kernel on PowerPC where hardware transactional memory is disabled. A local user can trigger a denial of service (TM Bad Thing exception and system crash) by sending a crafted signal frame via sigreturn() to arch/powerpc/kernel/signal_32.c and signal_64.c. Public d...

CVE-2020-11668

CVE-2020-11668 affects the Linux kernel drivers/media/usb/gspca/xirlink_cit.c (Xirlink camera USB driver). The issue arises from mishandling invalid USB descriptors in this driver, as reported in multiple advisories. The connected documents confirm that this vulnerability can enable a local attac...

CVE-2019-10207

The CVE-2019-10207 entry describes a local DoS in Linux kernels via Bluetooth UART mishandling. Affected: Linux kernel Bluetooth UART implementation, versions 3.x.x prior to 4.18.0 and 5.x.x. Vulnerable action: a crafted ioctl call by a local attacker with write access to Bluetooth hardware can c...

CVE-2020-25704

CVE-2020-25704 describes a memory leak in the Linux kernel perf subsystem when using PERF_EVENT_IOC_SET_FILTER, enabling a local user to exhaust resources and cause a denial of service. The vulnerability is reiterated across multiple advisories (e.g., ALAS2KERNEL, ALAS-2020-1566, Debian/AlmaLinux...

CVE-2026-46300

CVE-2026-46300 ("Fragnesia") is a local privilege escalation in the Linux kernel's ESP/XFRM (IPsec ESP-in-TCP) subsystem. The root cause is that skb_try_coalesce() fails to propagate the SKBFL_SHARED_FRAG marker when transferring paged fragments, causing ESP to skip skb_cow_data() and decrypt in ...

CVE-2017-18595

Linux kernel before 4.14.11 is affected by a double-free in allocate_trace_buffer (kernel/trace/trace.c). This CVE-2017-18595 issue can enable memory corruption when the trace buffer is allocated, and is exploitable with local access. The vulnerability is tied to kernel versions older than 4.14.1...

CVE-2019-11810

CVE-2019-11810 affects the Linux kernel up to version before 5.0.7. A NULL pointer dereference can occur when megasas_create_frame_pool() fails inside megasas_alloc_cmds() in drivers/scsi/megaraid/megaraid_sas_base.c, leading to a Denial of Service tied to a use-after-free. Public advisories note...

CVE-2021-46913

CVE-2021-46913 is a Linux kernel vulnerability affecting nf_tables (netfilter) via clone set element expression templates. It arises when initializing the connlimit expression list, causing connlimit garbage collector crashes during list walking. The Astra/Astra Linux bulletin notes the fix: use ...

CVE-2022-1729

CVE-2022-1729 describes a race condition in the Linux kernel perf_event_open() within the perf subsystem. An unprivileged local user could exploit this to gain root privileges, with potential follow-on impacts such as information leaks or arbitrary code execution as implied by multiple sources. C...

CVE-2019-14815

CVE-2019-14815 is a Linux kernel issue in the Marvell Mwifiex WiFi driver, described in the connected F5 advisory as a heap overflow in mwifiex_set_wmm_params(). The initial document also notes a heap overflow in this driver. The provided sources do not include explicit exploit details, affected ...

CVE-2023-3812

CVE-2023-3812 : Linux kernel TUN/TAP driver flaw allows local users to crash or possibly escalate privileges by generating a malicious oversized networking packet when napi frags is enabled. Root cause: out-of-bounds memory access in packet handling. Public details confirm impact and conditional ...

CVE-2021-43267

The CVE-2021-43267 issue affects the Linux kernel up to version 5.14.16 in the TIPC crypto path (net/tipc/crypto.c). The vulnerability arises from insufficient validation of user-supplied sizes for the MSG_CRYPTO message type, enabling remote attackers to potentially corrupt memory or escalate pr...

CVE-2023-0459

CVE-2023-0459: Linux kernel on 64-bit systems is affected by a local elevation of information disclosure due to Copy_from_user bypassing __uaccess_begin_nospec, bypassing access_ok and allowing a user to pass a kernel pointer to copy_from_user. Root cause is the __uaccess_begin_nospec handling. I...

CVE-2018-14634

CVE-2018-14634 is a Linux kernel integer overflow vulnerability in create_elf_tables(). An unprivileged local user with access to a SUID (or otherwise privileged) binary could escalate privileges. Documented vulnerable kernel families include 2.6.x, 3.10.x, and 4.14.x. Mitigations/recognitions ex...

CVE-2023-2177

CVE-2023-2177 describes a NULL pointer dereference in SCTP processing in Linux kernel: if stream_in allocation fails, stream_out is freed and later accessed, allowing a local user to crash the system or cause a denial of service. Affected component: net/sctp/stream_sched.c. Exploitation info is n...

CVE-2019-15239

The CVE-2019-15239 issue arises from a backported net/ipv4/tcp_output.c change in some 4.9.x and 4.14.x long-term Linux kernels that was correctly fixed in 4.16.12 but incorrectly backported to older LT kernels. This regression enables a local attacker to add to a write queue between disconnectio...

CVE-2020-8649

CVE-2020-8649 is a Linux kernel use-after-free in vgacon_invert_region (drivers/video/console/vgacon.c). The vulnerability, reported as CVE-2020-8649, could lead to memory corruption or DoS via the vgacon driver when a virtual terminal is accessed. Public details in Debian security advisories (DL...

CVE-2021-3669

CVE-2021-3669 is a Linux kernel vulnerability where measuring shared memory usage does not scale with large shared memory segment counts, enabling resource exhaustion and DoS. Connected sources confirm the issue affects multiple kernel versions and distributions, with remediations following vendo...

CVE-2023-35001

CVE-2023-35001 is a Linux kernel nftables vulnerability where the nft_byteorder expression mishandles vm register contents when CAP_NET_ADMIN exists in any user or network namespace, causing an out-of-bounds read/write in the nf_tables nft_byteorder path. Public references in the provided documen...

CVE-2023-0461

CVE-2023-0461 describes a use-after-free in the Linux kernel’s handling of TLS contexts on TCP sockets (icalled icsk_ulp_data) that can trigger a double-free when a TLS context is inherited by a reused listener. Affected scenario requires CONFIG_TLS to be enabled and may enable local privilege es...

CVE-2021-3490

Technical details about CVE-2021-3490 are not publicly provided in the supplied documents. Monitor for updates.

CVE-2019-10126

CVE-2019-10126 affects the Linux kernel Marvell mwifiex wireless kernel driver. The issue is a heap-based buffer overflow in mwifiex_uap_parse_tail_ies (drivers/net/wireless/marvell/mwifiex/ie.c) that can lead to memory corruption. Public documents in the Connected set identify the affected compo...

CVE-2022-1048

The CVE CVE-2022-1048 is a use-after-free vulnerability in the Linux kernel sound subsystem (ALSA PCM) caused by a race between concurrent hw_params and hw_free ioctls. Attacker-controlled timing on local access can crash the system or potentially escalate privileges. Affected component: Linux ke...

CVE-2022-23222

CVE-2022-23222 affects the Linux kernel Bitcoin? No. It targets kernel/bpf/verifier.c where pointer arithmetic on *_OR_NULL types can lead to privilege escalation. Affected: Linux kernel through 5.15.14 (local attacker). Connected advisories reference fixes in kernel package updates (e.g., ALAS/M...

CVE-2022-29581

CVE-2022-29581 : Affected component is the Linux kernel net/sched. The root cause is an Improper Update of Reference Count, enabling a local attacker to escalate privileges to root. The connected Astra Linux bulletin confirms the issue and states it affects Linux kernel versions prior to 5.18, an...

CVE-2018-20669

CVE-2018-20669 affects the Linux kernel i915_gem_execbuffer2_ioctl path (drivers/gpu/drm/i915/i915_gem_execbuffer.c) up to kernel 4.19.13. A local attacker can craft an IOCTL call that fails address checks (address provided to access_ok() is not checked), enabling overwriting arbitrary kernel mem...

CVE-2024-53150

The CVE-2024-53150 issue affects the Linux kernel USB-audio (ALSA: usb-audio). The root cause is that the driver does not validate the bLength field of descriptors while traversing clock-related descriptors, allowing a bogus shorter descriptor to cause out-of-bounds reads. The public patch adds s...

CVE-2021-46924

CVE-2021-46924 affects the Linux kernel NFC driver st21nfca. The issue is a memory leak caused by phy->pending_skb being allocated during device probe but not freed on error or remove paths. The connected Astra Linux bulletin and referenced kernel commits confirm the root cause and the remedia...

CVE-2021-46926

CVE-2021-46926 concerns the Linux kernel ALSA: hda: intel-sdw-acpi component. The flaw arises from the code setting an ACPI handle pointer before confirming the target is a SoundWire controller, allowing a graph-walk flow to continue after pointer assignment. A patch changes the logic to set call...

CVE-2019-5108

CVE-2019-5108 is an exploitable denial-of-service in the Linux kernel prior to mainline 5.3. An attacker can trigger IAPP location updates for stations before authentication completes by forging Authentication/Association Request packets, leading to potential CAM-table attacks or traffic flapping...

CVE-2020-7053

CVE-2020-7053 affects the Linux kernel: a use-after-free (write) in i915_ppgtt_close (drivers/gpu/drm/i915/i915_gem_gtt.c), linked to i915_gem_context_destroy_ioctl (i915_gem_context.c). Affected: Linux kernels 4.14 LTS up to 4.14.165, 4.19 LTS up to 4.19.96, and 5.x before 5.2. Root cause is a u...

CVE-2018-10902

CVE-2018-10902 is a Linux kernel local privilege-escalation flaw in the raw MIDI driver. The issue arises from a race on concurrent access in the snd_rawmidi_ioctl() path (snd_rawmidi_input_params and snd_rawmidi_output_status), causing a double-free/double-realloc in the rawmidi.c handler. Explo...

CVE-2019-16089

Summary (CVE-2019-16089): The vulnerability resides in the Linux kernel (through version 5.2.13) where nbd_genl_status in drivers/block/nbd.c does not validate the return value of nla_nest_start_noflag, potentially enabling local privilege impact due to improper netlink attribute nesting checks. ...

CVE-2019-19063

Concretely affected software: Linux kernel realtek rtlwifi USB driver (rtl_usb_probe in drivers/net/wireless/realtek/rtlwifi/usb.c). Root cause: two memory leaks in rtl_usb_probe() leading to memory exhaustion. Impact: potential denial of service due to unbounded memory consumption (through 5.3.1...

CVE-2019-19767

CVE-2019-19767 affects the Linux kernel prior to 5.4.2, due to mishandling of ext4_expand_extra_isize which can cause use-after-free in __ext4_expand_extra_isize and ext4_xattr_set_entry (fs/ext4/inode.c and fs/ext4/super.c; CID-4ea99936a163). This is a kernel-level vulnerability impacting ext4-r...

CVE-2019-18808

The CVE-2019-18808 entry describes a memory-leak DoS in the Linux kernel via ccp_run_sha_cmd() in ccp-ops.c (up to kernel 5.3.9). Connected Astra Linux advisories show a similar memory-leak DoS in ccp_run_aes_gcm_cmd() (drivers/crypto/ccp/ccp-ops.c) affecting Linux-5.10 and noting similarity to C...

CVE-2018-18397

The vulnerability CVE-2018-18397 affects the Linux kernel prior to 4.19.7, where the userfaultfd implementation mishandles access control for certain UFFDIO ioctls (fs/userfaultfd.c and mm/userfaultfd.c). A local attacker with read permissions on a tmpfs file containing holes could write data int...

CVE-2020-29368

Affected software: Linux kernel up to version prior to 5.7.5 (pre-5.7.5). Vulnerability details: In mm/huge_memory.c, __split_huge_pmd, the copy-on-write CoW implementation can grant unintended write access due to a race in the THP mapcount check. This race condition can lead to local write acces...

CVE-2021-46932

CVE-2021-46932 affects the Linux kernel’s input subsystem (Input: appletouch). The root cause is that input_dev->close() can cancel_work_sync(&dev->work) before dev->work is initialized (initialized after input_register_device()), causing a risk of a NULL work function in __flush_work()....

CVE-2020-29660

This CVE (CVE-2020-29660) affects the Linux kernel tty subsystem, specifically in drivers/tty/tty_io.c and drivers/tty/tty_jobctrl.c, where a locking inconsistency can enable a local attacker to perform a read-after-free against TIOCGSID. Consequences stated in multiple advisories include memory ...

CVE-2023-0394

CVE-2023-0394: A NULL pointer dereference in rawv6_push_pending_frames() of the Linux kernel (net/ipv6/raw.c) can cause a crash (DoS). The issue is confirmed across multiple advisories (e.g., Astra Linux and Brocade/SANnav postings) as a Linux kernel vulnerability, with no explicit public exploit...

CVE-2024-26591

CVE-2024-26591: Linux kernel vulnerability in bpf_tracing_prog_attach can crash with NULL pointer dereference due to missing attach_btf when attaching tracing programs (rawtp/fentry chain). The issue arises in a sequence of loading a rawtp program, loading an fentry with rawtp as target, creating...