CVE-2023-53038

CVE-2023-53038 concerns the Linux kernel: in scsi lpfc, the function lpfc_sli4_cgn_params_read() may encounter a kzalloc() failure, after which lpfc_read_object() dereferences pdata without a NULL check. The published fix changes the error code path from -ENODEV to -ENOMEM to reflect allocation f...

CVE-2023-52899

CVE-2023-52899 – kernel vulnerability (Linux kernel) has concrete details in connected advisories: a missing protection in the AXI channel error handling path (axi_chan_handle_err) for the vd signal can lead to a NULL pointer dereference and kernel panic. The issue is described as “Add exception ...

CVE-2023-53019

CVE-2023-53019 concerns the Linux kernel: the net/mdio subsystem allowed an out-of-bounds access in mdiobus_get_phy() when an invalid addr is passed (e.g., -1 in stmmac_init_phy). The advisory notes that addr must be validated before use to prevent access to mdio_map. Impact is described as high,...

CVE-2023-53106

CVE-2023-53106 is a Linux kernel use-after-free in the NFC st-nci driver (ndlc_remove) caused by a race between scheduled work (llt_ndlc_sm_work) and driver removal. The race may allow use-after-free of ndlc->ndev during ndlc_rcv_queue/nci_recv_frame, affecting both st_nci_i2c_remove and st_nc...

CVE-2024-1312

CVE-2024-1312 is a Linux kernel vulnerability: a use-after-free in the Memory Management subsystem caused by a race in mas_prev_slot can allow a local user to crash the system. The issue affects the kernel code path handling virtual memory areas, with exploitation described as a local privilege c...

CVE-2024-22386

CVE-2024-22386 involves a race condition in the Linux kernel’s drm/exynos driver (exynos_drm_crtc_atomic_disable) that can cause a NULL dereference, potentially leading to kernel panics or denial of service. Connected Nessus/NASL entries for Unity Linux (UTSA-2026-004378 and related advisories) c...

CVE-2024-26723

CVE-2024-26723 affects the lan966x portion of the Linux kernel. A crash occurs when adding an interface under a bond (lag) because some ports can be NULL pointers (not probed); the code iterates over ports and dereferences NULL. The fix is to check for NULL pointers before accessing port data. Th...

CVE-2024-35920

In CVE-2024-35920, a race/NULL-pointer risk was addressed in the Linux kernel’s media: mediatek vcodec path. The fix adds a lock to protect the ctx_list to prevent dereferencing a NULL ctx_list in vpu_dec_ipi_handler when the list was deleted due to SCP IP block behavior, preventing a kernel oops...

CVE-2024-36890

CVE-2024-36890: Linux kernel mm/slab fix to have __free(kfree) treat error pointers as valid data. Previously, automatic cleanup could crash if an allocation freed as an error pointer was not checked; wm831x_gpio_dbg_show() is cited as an example. The resolution updates the auto cleanup path to v...

CVE-2024-36900

CVE-2024-36900 affects the Linux kernel’s net/hns3 driver. The vulnerability arises when a devlink reload occurs during hardware initialization: the reload can access hardware resources before initialization, potentially causing a kernel crash. The fix is to register devlink after hardware initia...

CVE-2024-38572

CVE-2024-38572 concerns the Linux kernel wifi driver ath12k. The issue is a missing terminator entry in ath12k_qmi_msg_handlers, which can trigger a global out-of-bounds read in qmi_invoke_handler via KASAN. A fix adds a dummy terminator entry to allow qmi_invoke_handler to traverse to the termin...

CVE-2024-38616

CVE-2024-38616 affects the Linux kernel wifi: carl9170 stack. The issue is a fortified-memset warning triggered in carl9170_tx_release (inlined via kref_put and carl9170_tx_put_skb) in randconfig builds. The root cause is a Fortify warning in fortify_memset_chk due to memory bounds handling; patc...

CVE-2024-40938

CVE-2024-40938 affects the Linux kernel Landlock component, addressing a d_parent walk issue when linking a root mount point. The root cause was a WARN_ON_ONCE triggered by using the source directory’s d_parent even if the source is mounted, because the VFS check runs after security_path_link(). ...

CVE-2024-42066

CVE-2024-42066 is a Linux kernel vulnerability affecting DRM Xe: a potential integer overflow in page size calculation when computing min_page_size. The issue stems from not casting tbo->page_alignment to a 64-bit type before bit-shifting, enabling overflow in the calculation. The connected As...

CVE-2024-42108

Technical details for CVE-2024-42108 are not publicly provided in the connected documents. The available sources reference the vulnerability at a high level. Monitor for updates from kernel advisories and vendor patches.

CVE-2024-42234

CVE-2024-42234 refers to a Linux kernel vulnerability resolved by a fix for crashes during deferred split folio migration. The root cause involves deferred_split_scan() moving folios to a local list without proper protection, with folio->_deferred_list not being secured, potentially leading to...

CVE-2024-44953

The CVE-2024-44953 entry documents a Linux kernel SCSI/UFS deadlock in RTC update handling triggered by runtime suspend waiting for RTC work flush, where the RTC work calls ufshcd_rpm_get_sync() to wait for runtime resume. The deadlock trace is provided, and the issue is stated to be resolved by ...

CVE-2024-45013

CVE-2024-45013 - Linux kernel NVMe keep-alive handling : The vulnerability stemmed from not stopping the NVMe keep-alive when unloading the host driver, creating a use-after-free path if controller startup fails. The fix moves the stopping keep-alive step into nvme_uninit_ctrl(), aligning it with...

CVE-2024-46709

The CVE-2024-46709 issue affects the Linux kernel drm/vmwgfx driver, fixed by ensuring external buffers map through the dma_buf interface instead of direct page access. The vulnerability arises because external buffers may not expose readable/writable pages, so media buffers (bo) created from ext...

CVE-2024-46741

The CVE-2024-46741 issue is in the Linux kernel’s misc/fastrpc subsystem. The root cause is a double free of the fastrpc buffer in the error path of fastrpc_req_mmap(): the buffer is freed in fastrpc_req_munmap_impl() on a successful unmap, but there is an unconditional call to fastrpc_buf_free()...

CVE-2024-46776

The CVE-2024-46776 entry corresponds to a Linux kernel flaw in the DRM/AMD display pipeline. The issue arises when the DC_LOG_DC is executed before verifying link_enc, allowing an invalid state that prompted a reported reverse_inull defect; the fix corrects the sequence by running DC_LOG_DC only ...

CVE-2024-49873

CVE-2024-49873 : In the Linux kernel, memfd_pin_folios with THP-backed memory may panic or cause a NULL-pointer dereference when the requested start offset is not aligned to a huge page boundary. The issue arises because filemap_get_folios_contig could load a folio that is a sibling and then fail...

CVE-2024-50144

The CVE-2024-50144 issue affects the Linux kernel DRM/XE path. Root cause: an unbalanced rpm put() can occur if fence_fini() is invoked twice on error while handling GuC CT for a tlb request, because the code path signals the fence and then returns an error, causing the caller to run fini() again...

CVE-2024-50254

CVE-2024-50254 : In the Linux kernel, the bpf_iter_bits_destroy() path incorrectly used kit->nr_bits bit = kit->nr_bits on completion, uses !nr_bits || bits >= nr_bits to determine completion, and keeps nr_bits > 64 to indicate dynamic allocation. It also changes kit->nr_bits from ...

CVE-2024-50270

CVE-2024-50270 targets the Linux kernel, specifically in mm/damon/core where damon_feed_loop_next_input() contains overflow-prone calculations (score_goal_diff_bp, compensation, etc.) related to a constant target score of 10,000. The fix rewrites the function to avoid overflows and removes the un...

CVE-2024-50288

CVE-2024-50288 affects the Linux kernel vivid driver (video capture path). The issue arises in vivid_create_queue handling of video capture buffers: the video capture queue can request up to 64 buffers, but the must_blank array remained sized for 32 (VIDEO_MAX_FRAME), causing an out-of-bounds wri...

CVE-2024-56555

CVE-2024-56555 affects the Linux kernel binder subsystem. A race in binder_add_freeze_work() can occur when the process’ rbtree (proc->nodes) lock is intermittently dropped to acquire node locks, allowing binder_deferred_release() to move nodes to binder_dead_nodes. This can corrupt the rb_nex...

CVE-2024-57880

Technical details about CVE-2024-57880 are not provided in the connected documents. Public specifics, affected products, and fixes are not disclosed here; monitor for updates.

CVE-2025-22098

CVE-2025-22098 affects the Linux kernel’s DRM for ZynqMP DP. The issue is a deadlock in zynqmp_dp_ignore_hpd_set caused by attempting to lock the same mutex twice; the fix is to lock and unlock it properly (instead of locking twice). The vulnerability was identified by the Clang thread-safety ana...

CVE-2025-37751

The CVE affects the Linux kernel x86 CPU code. It arises from removing the NULL terminator at the end of the AMD erratum table during the switch from x86_cpu_desc to x86_cpu_id, causing readers to read past the end of the array. The fixed behavior is to replace the NULL terminator. Connected sour...

CVE-2025-37870

Technical details about CVE-2025-37870 are not publicly provided in the supplied documents. Please monitor for updates from vendors and security advisories.

CVE-2025-37906

CVE-2025-37906 concerns the Linux kernel’s ublk driver where a race can occur between io_uring_cmd_complete_in_task and ublk_cancel_cmd. Specifically, ublk_cancel_cmd() may call io_uring_cmd_done() to finish an uring_cmd while a scheduled task work via io_uring_cmd_complete_in_task() is still pen...

CVE-2025-38005

CVE-2025-38005 affects the Linux kernel DMA engine TI k3-udma driver. The root cause is a missing locking in k3-udma.c; the provided docs note that a commit adding the missing locking resolves the issue. Remediation: apply the kernel patch/updated driver version that includes the locking fix (as ...

CVE-2025-38051

CVE-2025-38051 affects the Linux kernel CIFS client: a race in the readdir/concurrency path allows a use-after-free in cifs_fill_dirent when the rsp buffer is freed, leading to a reported KASAN-use-after-free. The vulnerability is tracked with a CVSSv3.1 vector of CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U...

CVE-2025-38060

The CVE-2025-38060 entry describes a Linux kernel BPF verifier bug: copy_verifier_state() failed to copy the loop_entry field, allowing .loop_entry values from unrelated states to pollute env->cur_state. This can cause incorrect state tracking during verification, since env->stack states ma...

CVE-2025-38098

The CVE-2025-38098 issue affects the Linux kernel DRM AMD display stack. It centers on treating a wb (writeback) connector as physical in create_validate_stream_for_sink, and incorrect handling when operating on a drm_wb_connector as an amdgpu_dm_connector. The description notes that dereferencin...

CVE-2025-38219

CVE-2025-38219 affects the Linux kernel F2FS code path. The issue is a downgrade-related negative i_nlink scenario that could trigger a kernel warning; the vulnerability was resolved in the cited upstream code path (f2fs_i_links_write -> f2fs_drop_nlink -> f2fs_unlink), as shown in the conn...

CVE-2025-38300

CVE-2025-38300: In the Linux kernel sun8i-ce-cipher path (sun8i_ce_cipher_prepare), two DMA cleanup issues on the error path are fixed. 1) On the theend_sgs error path, dma_unmap is now performed only if the corresponding dma_map_sg() succeeded for areq->dst. 2) On the theend_iv path, dma_unma...

CVE-2025-38369

CVE-2025-38369 affects the Linux kernel DMA engine idxd path. Under certain container configurations running IDXD workloads with /dev mounted can trigger a call trace or kernel panic when the parent process of the container is terminated. Root cause described: Docker’s mount replication propagati...

CVE-2025-38377

CVE-2025-38377 : Linux kernel vulnerability in rose_rt_device_down() can cause use-after-free by corrupting the neighbour loop (loop bound altered and index increment after removal). A reverse-iteration fix with a fixed loop bound was applied to ensure all entries are examined and removals do not...

CVE-2025-38382

The CVE-2025-38382 entry concerns a Linux kernel bug in btrfs related to iterating extrefs during log replay. Specifically, in __inode_add_ref(), processing extrefs could jump to a next label with victim_name.len uninitialized, causing undefined memory access in the next loop iteration. The docum...

CVE-2025-38392

CVE-2025-38392 (Linux kernel) describes a concurrency issue in the idpf driver where a control queue mutex (cq_lock) is held across operations that may sleep, triggering warnings during module load when VIRTCHNL2_CAP_MACFILTER is ON. The fix converts cq_lock from a mutex to a spinlock to avoid sl...

CVE-2025-38453

CVE-2025-38453 affects the Linux kernel io_uring/msg_ring path, where io_kiocb freeing could occur while a previously freed request is still in use. The connected docs specify a root cause: requests allocated and freed independently in msg_ring can race with RCUs, risking use-after-free. The reco...

CVE-2026-52991

CVE-2026-52991 concerns a race in the Linux kernel PSI subsystem where a use-after-free can occur due to a race between pressure_write and cgroup file release touching the priv member of struct kernfs_open_file. The issue is fixed by widening the scope of the cgroup_mutex in pressure_write to cov...

CVE-2026-53360

The CVE-2026-53360 entry concerns a Linux kernel KVM/SEV issue: if GHCB v2+ is used, in-GHCB scratch area must reside in the shared buffer. The root cause is a bounds check flaw in snp_begin_psc() where idx_end is validated against VMGEXIT_PSC_MAX_COUNT (253) but not against the actual buffer siz...

CVE-2005-3359

CVE-2005-3359 affects Linux kernel 2.6.x (atm module) where certain socket calls can produce inconsistent references counts on loadable protocol modules, enabling a local user to trigger a denial of service (panic). Publicly documented in Debian/DSA-1103-1 and Red Hat/CESA-RHSA-2006:0493 style ad...

CVE-2010-0007

CVE-2010-0007 affects the Linux kernel’s ebtables in netfilter, where netfilter/ebtables.c allows local users to modify rules without CAP_NET_ADMIN, bypassing access restrictions and enabling arbitrary network-traffic filtering via a modified ebtables user-space tool. Vulnerable: kernel before 2....

CVE-2011-1598

CVE-2011-1598 affects the Linux kernel’s CAN subsystem: the bcm_release function in net/can/bcm.c does not validate a socket data structure, enabling a local user to trigger a NULL pointer dereference and cause a denial of service. The affected version range is kernel 2.6.39-rc6 and earlier. Reso...

CVE-2011-2494

The CVE-2011-2494 issue affects the Linux kernel (taskstats.c) up to version before 3.1. Local users can obtain sensitive I/O statistics by sending taskstats commands to a netlink socket, with the description noting this could reveal password length information. The vulnerability’s root cause is ...

CVE-2013-1928

CVE-2013-1928 affects the Linux kernel prior to 3.6.5. The do_video_set_spu_palette function in fs/compat_ioctl.c lacks an error check, potentially enabling local attackers to read sensitive kernel stack memory via a crafted VIDEO_SET_SPU_PALETTE ioctl on a /dev/dvb device. The issue is addressed...