CVE-2026-53365

In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: fix zerocopy completion for multi-skb sends When a large message is fragmented into multiple skbs, the zerocopyuarg is only allocated and attached to the last skb in the loop.Non-final skbs carry pinned user pages w...

CVE-2004-1072

CVE-2004-1072 describes a vulnerability in the Linux kernel where the binfmt_elf loader (binfmt_elf.c) may create an interpreter name string that is not NULL terminated, allowing strings longer than PATH_MAX to be used. This can cause buffer overflows that may lead to a local denial of service (h...

CVE-2007-2875

CVE-2007-2875 concerns an Integer underflow in cpuset_tasks_read of the Linux kernel when the cpuset filesystem is mounted. The issue affects kernels prior to 2.6.20.13 and 2.6.21.x prior to 2.6.21.4, allowing a local attacker to read kernel memory contents by supplying a large offset while readi...

CVE-2007-2876

CVE-2007-2876 affects Linux kernel SCTP Netfilter connection-tracking code (ip_conntrack_proto_sctp.c and nf_conntrack_proto_sctp.c). A remote attacker can trigger a denial of service by causing certain invalid SCTP states that lead to a NULL pointer dereference. Impact is a complete availability...

CVE-2009-1961

CVE-2009-1961 is a local-denial-of-service vulnerability in the Linux kernel related to the inode double-locking path in fs/ocfs2/file.c. A sequence of splice system calls can deadlock between generic_file_splice_write, splice_from_pipe, and ocfs2_file_splice_write, preventing file creation/remov...

CVE-2010-2537

CVE-2010-2537 affects the Linux kernel’s btrfs_ioctl_clone path: the btrfs_ioctl_clone function in fs/btrfs/ioctl.c before 2.6.35 allows a local attacker to overwrite an append‑only file when using BTRFS_IOC_CLONE or BTRFS_IOC_CLONE_RANGE with a donor file. Impact is local privilege/unauthorized ...

CVE-2010-4248

The CVE-2010-4248 issue affects the Linux kernel prior to 2.6.37-rc2. It is a race condition in the __exit_signal function (kernel/exit.c) that can be triggered by multithreaded exec paths, with related dynamics involving a thread group leader in kernel/posix-cpu-timers.c and the reassignment of ...

CVE-2011-1748

CVE-2011-1748 affects the Linux kernel: the raw_release function in net/can/raw.c fails to validate a socket data structure, enabling local users to trigger a NULL pointer dereference (denial of service) or possibly other impact via a crafted release operation. Affected versions are the kernel be...

CVE-2012-0045

CVE-2012-0045 relates to the Linux kernel KVM 32-bit syscall emulation. A flaw in arch/x86/kvm/emulate.c where the 0f05 (syscall) opcode is not handled correctly allows a user in a 32-bit guest to crash the guest OS (denial of service). Public references in the provided connected documents confir...

CVE-2012-4461

CVE-2012-4461 overview: The Linux kernel KVM subsystem (pre-3.6.9) on hosts using qemu userspace without XSAVE is vulnerable. A local attacker can trigger a denial of service (kernel OOPS) by calling KVM_SET_SREGS to enable the X86_CR4_OSXSAVE bit in the guest CR4, then issuing KVM_RUN. The conne...

CVE-2013-3225

CVE-2013-3225 — Linux kernel local information disclosure . Affected: Linux kernel versions prior to 3.9-rc7, specifically the rfcomm_sock_recvmsg() path in net/bluetooth/rfcomm/sock.c. Root cause: an uninitialized length variable in recvmsg/recvfrom handling leads to leakage of kernel stack memo...

CVE-2015-9004

CVE-2015-9004 affects the Linux kernel up to version 3.18 (pre-3.19). The flaw is in kernel/events/core.c where improper handling of counter grouping enables local privilege escalation via crafted apps, involving perf_pmu_register and perf_event_open. The impact is local Privilege Escalation with...

CVE-2016-2854

CVE-2016-2854 concerns the AUFS module in the Linux kernel (versions 3.x/4.x), which does not properly maintain POSIX ACL xattr data. This can allow a local attacker to gain privileges by exploiting a group-writable setgid directory. The connected documents confirm the vulnerability and its local...

CVE-2017-5576

CVE-2017-5576 affects the Linux kernel VideoCore DRM driver (vc4) via vc4_get_bcl in drivers/gpu/drm/vc4/vc4_gem.c. An integer overflow when handling a crafted size in VC4_SUBMIT_CL ioctl can enable a local denial of service or possibly other impact. Present in kernel versions before 4.9.7; patch...

CVE-2018-12931

CVE-2018-12931 affects the Linux kernel ntfs.ko (ntfs_attr_find) in kernel 4.15.0, enabling a stack-based out-of-bounds write that can cause a denial of service (kernel oops/panic) or other unspecified impact via a crafted NTFS filesystem. The vulnerability is confirmed in multiple advisories (e....

CVE-2020-36387

CVE-2020-36387 affects the Linux kernel up to version 5.8.2, where a use-after-free exists in fs/io_uring.c related to io_async_task_func and ctx reference holding (CID-6d816e088c35). Multiple connected advisories reference Linux kernels before 5.8.2 and indicate that patch/update to 5.8.2 or lat...

CVE-2021-47020

CVE-2021-47020 is a Linux kernel vulnerability in the SoundWire subsystem. The issue is a memory leak in the stream config error path for soundwire: stream: when stream config fails, the master runtime releases slave_runtimes from the slave_rt_list but the slave runtime is not added to that list ...

CVE-2021-47095

CVE-2021-47095 affects the Linux kernel’s ipmi_ssif (ssif) driver. The root cause was dereferencing ssif_info->client in an error path before it was guaranteed to be set, leading to a NULL pointer dereference and a kernel crash. The fix initializes ssif_info->client before any error path ca...

CVE-2021-47135

CVE-2021-47135 relates to the Linux kernel mt76 mt7921 driver. Public docs show a fix for an AOOB/array-out-of-bounds issue in mt7921_mcu_tx_rate_report and removal of an unnecessary variable, addressing an out-of-bounds access. References point to upstream stable commits (d874e6c069… and 6919e8a...

CVE-2021-47145

CVE-2021-47145 affects the Linux kernel (btrfs) where a BUG_ON in link_to_fixup_dir can trigger a kernel panic during error paths in log recovery. The description shows a replay/recover flow (replay_one_buffer, btrfs_recover_log_trees, open_ctree) panicking with an invalid opcode in fs/btrfs/tree...

CVE-2021-47167

CVE-2021-47167 is a Linux kernel issue affecting NFS: an Oopsable condition in __nfs_pageio_add_request() could occur. The patch ensures that nfs_pageio_error_cleanup() resets the mirror array contents so the structure reflects an empty state, and it makes nfs_pageio_do_add_request() more robust ...

CVE-2021-47249

CVE-2021-47249 concerns a memory-leak in the Linux kernel’s net: rds path, fixed by correcting refcount handling in rds_recvmsg. The issue occurred when an error happened in rds_cmsg_recv(): after a successful rds_next_incoming(rs, &inc) the code would increment inc’s refcount, but on failure to ...

CVE-2021-47325

CVE-2021-47325 concerns the Linux kernel’s iommu/arm-smmu subsystem. The issue is a refcount leak in arm_smmu_iova_to_phys_hard() where, on several error paths, the refcount of the underlying smmu object, increased by arm_smmu_rpm_get(), is not decremented. The fixed workaround described in the p...

CVE-2021-47327

The Linux kernel contains a reference counting vulnerability in the iommu/arm-smmu driver (specifically the arm_smmu_device refcount). The root cause is that the arm_smmu_rpm_get() function invokes pm_runtime_get_sync(), which increments the "smmu" refcount even when the return value is less than...

CVE-2021-47376

CVE-2021-47376 is a Linux kernel issue where an oversize allocation in kmalloc path could trigger a warning during BPF verification. The provided description and connected advisories indicate the fix adds an oversize check before kvcalloc() via the commit that introduces the guard in mm/kvmalloc(...

CVE-2021-47419

CVE-2021-47419 affects Linux kernel net/sched sch_taprio. A timer is set before a packet arrives and may not be canceled if ops->reset is not invoked; the fix cancels the timer in taprio_destroy (destroy path). Connected docs specify the root cause (timer scheduled before packet processing) an...

CVE-2021-47421

CVE-2021-47421 affects the Linux kernel amdgpu driver. The root cause is that during PCI error handling, the code may release a write lock in amdgpu_pci_resume even when not safely holding it, leading to potential deadlocks when other threads acquire a read lock. The fix, documented across connec...

CVE-2021-47442

The CVE-2021-47442 issue affects the Linux kernel NFC digital path. The vulnerability arises because skb is allocated in digital_in_send_sdd_req() but is not freed when digital_in_send_cmd() fails, leading to a memory leak. The fix is to free skb if digital_in_send_cmd() returns a failure. Report...

CVE-2021-47479

The CVE-2021-47479 entry concerns the Linux kernel staging driver rtl8712 (rtl8712_dl_fw) with a use-after-free caused by a race between r871xu_dev_remove() and the ndo_open() callback. The issue arises when firmware is freed before the network device is unregistered, allowing the driver to acces...

CVE-2021-47642

CVE-2021-47642: in the Linux kernel’s video fbdev/nvidiafb path, a fixed-size buffer overrun could occur by copying a channel name with strcpy into chan->adapter.name. The defect arises from copying into a 48-char buffer without length checks; fix is to use strscpy() to prevent overflows. The ...

CVE-2022-3110

CVE-2022-3110 affects the Linux kernel (through 5.16-rc6) and is tied to the r8188eu wireless driver. The vulnerability is in _rtw_init_xmit_priv (drivers/staging/r8188eu/core/rtw_xmit.c), where the return value of rtw_alloc_hwxmits() is not checked, which may lead to a NULL pointer dereference. ...

CVE-2022-48710

CVE-2022-48710 concerns the Linux kernel Radeon driver. Inradeon_fp_native_mode() , the code assigns the return ofdrm_mode_duplicate() to a mode pointer and may dereference a NULL on failure. The issue is resolved by adding a NULL-pointer check to avoid NP: when drm_mode_duplicate() fails, and th...

CVE-2022-48824

CVE-2022-48824 : In the Linux kernel, the scsi myrs driver can crash during error handling. If privdata->hw_init() fails non‑zero, myrs_detect() leaves cs->disable_intr as NULL and myrs_cleanup() dereferences a NULL pointer, causing a kernel crash with a NULL pointer dereference. The issue ...

CVE-2022-48891

CVE-2022-48891 – Linux kernel regulator (da9211): The issue arises if the IRQ handler is enabled before regulator structures are ready (e.g., when booting from kexec), potentially causing a crash due to an unreadable memory access. The patch fixes the initialization order to ensure the IRQ handle...

CVE-2022-49052

Summary (CVE-2022-49052) : The Linux kernel memory management path mm/page_io.c with zram swap could expose zeroed data to a process during CLONE_VM cloning, leading to potential data corruption. The root cause was the bogus swap_slot_free_notify in the CLONE_VM scenario, which didn’t correctly t...

CVE-2022-49112

CVE-2022-49112 is a Linux kernel issue described in the provided docs as a fix for a monitor-mode crash involving the mt76/mt7921s stack. The problem arises when a CTS packet in monitor mode could cause improper skb handling due to only the first RXD buffer being linear; pulling RXD-size+6 bytes ...

CVE-2022-49113

CVE-2022-49113 — In the Linux kernel, a refcount leak in powerpc/secvar, specifically in format_show(), is fixed. The leak can occur when format_show returns failure in multiple paths. The mitigation is the unified management of of_node_put to correct the leak. The available connected sources con...

CVE-2022-49120

CVE-2022-49120 pertains to the Linux kernel SCSI pm8001 path. The vulnerability is a task leak in pm8001_send_abort_all() where allocated SAS tasks may not be freed if pm8001_tag_alloc() or pm8001_mpi_build_cmd() fail. The fix ensures proper freeing of the SAS task in those failure paths. Public ...

CVE-2022-49144

CVE-2022-49144 pertains to the Linux kernel io_uring subsystem. The issue stems from a memory-leak when registering files: if there are no files to process in __io_sqe_files_scm(), the code frees resources but forgets to restore the uid, leading to a leak. The connected documents confirm this exa...

CVE-2022-49187

The CVE-2022-49187 entry concerns the Linux kernel clk subsystem. A NULL device pointer in clk_core (often from clk_register/clk_hw_register paths) can lead to a NULL pointer dereference when clk_hw_get_clk() is invoked on a clk_hw whose clk_core.dev is NULL, due to a call to dev_name() on NULL. ...

CVE-2022-49260

CVE-2022-49260 affects the Linux kernel crypto path: crypto: hisilicon/sec, where the aead software fallback for the engine could mismanage private context memory due to a subreq pointer mishandling, potentially causing an OS panic when configuring a 64K page. The connected documents confirm a fi...

CVE-2022-49271

CVE-2022-49271 affects the Linux kernel CIFS/SMB2 code. When smb2_ioctl_query_info() is called with flags=PASSTHRU_FSCTL and output_buffer_length=0, the kernel could copy a bad pointer (buffer) and end up dereferencing NULL, potentially leading to a NULL pointer dereference. The fix also ensures ...

CVE-2022-49337

The CVE-2022-49337 issue affects the Linux kernel OCFS2 DLM: dlmfs user_dlm_destroy_lock error handling could leave flags set, causing unlink to remove inodes while a dlm lock remains linked, risking a user-after-free panic. The advisory states that USER_LOCK_IN_TEARDOWN must be reverted on failu...

CVE-2022-49352

CVE-2022-49352 relates to the Linux kernel ext4: fix warning in ext4_handle_inode_extension, where a write path can trigger inode size accounting inconsistencies under memory pressure. The issue describes an observed sequence where inode.i_size is 4096, but EXT4_I(inode)->i_disksize is set to ...

CVE-2022-49402

CVE-2022-49402 concerns the Linux kernel ftrace hashing of direct_functions. The issue triggers a general protection fault when register_ftrace_direct fails, due to the entry not being removed from direct_functions. The available connected docs confirm the root cause and the fix: remove the entry...

CVE-2022-49431

CVE-2022-49431 concerns the Linux kernel powerpc iommu: a missing of_node_put in iommu_init_early_dart leads to a refcount leak for the device_node returned by of_find_compatible_node. The issue is local in scope (AV:L, AC:L, PR:L, UI:N) with a high impact on availability and a moderate base scor...

CVE-2022-49438

CVE-2022-49438 : In the Linux kernel, the refcount leak occurs in the path handling for device tree lookups. Specifically, of_find_node_by_path() using of_find_node_opts_by_path() returns a node pointer with an incremented refcount, but the code did not call of_node_put() when done, causing a ref...

CVE-2022-49533

CVE-2022-49533 relates to the Linux kernel ath11k driver, where a buffer overflow could occur while copying SSIDs into the scan_req_params structure during hardware scanning. The root cause is the mismatch between the number of SSIDs supported (16) and the structure’s capacity (10), potentially a...

CVE-2022-49649

CVE-2022-49649 affects the Linux kernel under xen_netback, where xenvif_rx_next_skb() can be called with an empty RX queue during repeated iterations in xenvif_rx_action(), risking a kernel NULL pointer dereference. The provided crash trace centers on xenvif_rx_skb() and the related netback loop....

CVE-2022-49668

The CVE-2022-49668 entry corresponds to a Linux kernel issue where refcount leaks occur in the devfreq helper path: of_get_child_by_name() returns a node with an incremented refcount, and of_node_put() was missing in error paths. The fix adds the missing of_node_put() calls to prevent a refcount ...