CVE-2025-38200

Technical details about CVE-2025-38200 are not provided in the supplied documents. The initial entry mentions a Linux kernel MMIO underflow fix but contains no product/vendor/version specifics beyond kernel change. Monitor for updates.

CVE-2025-38351

CVE-2025-38351 affects the Linux kernel KVM component (x86) when Hyper-V hypercalls are enabled. The issue arises in PV TLB flush processing where non-canonical GVAs can reach INVVPID/INVLPGA paths, potentially triggering VM-Fail on Intel hardware (AMD may ignore). In practice, this can allow a g...

CVE-2025-38377

CVE-2025-38377 : Linux kernel vulnerability in rose_rt_device_down() can cause use-after-free by corrupting the neighbour loop (loop bound altered and index increment after removal). A reverse-iteration fix with a fixed loop bound was applied to ensure all entries are examined and removals do not...

CVE-2025-38443

CVE-2025-38443 affects the Linux kernel (nbd subsystem). A use-after-free occurs in the nbd_genl_connect() error path when nbd_start_device() is called but cleanup continues to use nbd->config, leading to freeing of memory in recv_work. The issue is triggered during certain error paths after d...

CVE-2025-38457

CVE-2025-38457 concerns a Linux kernel net/sched bug where grafting a qdisc to a non-existent parent class could cause a failure during qdisc initialization. The fix introduces early validation via qdisc_leaf so that attempting to attach to a non-class parent aborts before qdisc_create. Affected ...

CVE-2025-38466

CVE-2025-38466 is a Linux kernel security issue where uprobes could be abused due to inability to reliably verify instruction boundaries in the middle of an instruction, and on some architectures (e.g., arm64) when data words are misinterpreted as instructions. The fix reverts to requiring CAP_SY...

CVE-2025-38544

CVE-2025-38544 : The Linux kernel’s rxrpc implementation had a bug where preallocated call IDs could collide, triggering cleanup assertions when an in-use ID was released. The fix sets the call state in rxrpc_service_prealloc_one() and marks the call as released before cleanup, preventing both as...

CVE-2026-23392

The CVE-2026-23392 vulnerability affects the Linux kernel nf_tables flowtable handling. Root cause: during error paths, a hook may still reference a flowtable, exposing it to the packet path and nfnetlink control plane. The fix inserts synchronize_rcu() after unregistering hooks (rcu grace period...

CVE-2026-31589

The CVE-2026-31589 issue affects the Linux kernel memory management in the mm path related to folio_unmap_invalidate. The vulnerability arises when the system calls free_folio() directly, instead of loading the free_folio function pointer after obtaining a mapping reference or lock, potentially l...

CVE-2026-53357

CVE-2026-53357 affects the Linux kernel Bluetooth stack. Root cause: a race where a concurrent HCI disconnect can trigger l2cap_conn_del() to free a child socket via l2cap_sock_kill while cleanup_listen() still accesses it, causing a use-after-free (KASAN) in l2cap_sock_cleanup_listen() during cl...

CVE-1999-0656

The CVE-1999-0656 issue affects the ugidd RPC interface and allows remote enumeration of valid usernames by querying arbitrary UIDs mapped to local user/group names. Connected documents indicate affected kernel packages in Linux distributions (e.g., CBL Mariner and Red Hat-sourced advisories) wit...

CVE-2006-3468

CVE-2006-3468 affects the Linux kernel 2.6.x when NFS and EXT3 are used. A remote attacker can trigger a denial of service by sending a crafted UDP packet containing a V2 lookup procedure that specifies a bad file handle (inode number). This triggers an error and causes the exported directory to ...

CVE-2007-2876

CVE-2007-2876 affects Linux kernel SCTP Netfilter connection-tracking code (ip_conntrack_proto_sctp.c and nf_conntrack_proto_sctp.c). A remote attacker can trigger a denial of service by causing certain invalid SCTP states that lead to a NULL pointer dereference. Impact is a complete availability...

CVE-2008-2812

CVE-2008-2812 affects the Linux kernel prior to 2.6.25.10, with NULL pointer dereferences in tty handling (notably in drivers/net/ such as hamradio, irda, ppp, slip, wan, and wireless components) potentially enabling local privilege escalation or a system crash. The issue arises from missing chec...

CVE-2010-0298

Summary: CVE-2010-0298 affects the x86 emulator in KVM 83, where CPL/IOPL checks are not applied to CPL3 memory accesses, enabling a guest OS user to crash the guest or gain privileges via an IO port or MMIO region (related to CVE-2010-0306). What is affected: KVM/x86 emulator code in affected Li...

CVE-2010-3297

CVE-2010-3297 affects the Linux kernel net/eql driver; the eql_g_master_cfg function in drivers/net/eql.c did not initialize a structure member, enabling local users to read kernel stack memory via an EQL_GETMASTRCFG ioctl. Affects kernels before 2.6.36-rc5; corrected in subsequent patches (net/e...

CVE-2010-3298

CVE-2010-3298 affects the Linux kernel. The hso_get_count function in drivers/net/usb/hso.c, in kernel builds before 2.6.36-rc5, does not initialize a certain structure member, which allows local users to read potentially sensitive information from kernel stack memory via the TIOCGICOUNT ioctl. T...

CVE-2011-1748

CVE-2011-1748 affects the Linux kernel: the raw_release function in net/can/raw.c fails to validate a socket data structure, enabling local users to trigger a NULL pointer dereference (denial of service) or possibly other impact via a crafted release operation. Affected versions are the kernel be...

CVE-2012-0044

CVE-2012-0044 is an integer overflow in drm_mode_dirtyfb_ioctl() within Linux kernel drivers/gpu/drm/drm_crtc.c, vulnerable before 3.1.5. The flaw allows local users to gain privileges or trigger memory corruption/DoS via a crafted ioctl. Public sources (including MiracleLinux AXSA-2012-646:05) c...

CVE-2012-6647

The CVE-2012-6647 issue affects the Linux kernel futex_wait_requeue_pi implementation in kernel/futex.c, vulnerable in versions before 3.5.1. The flaw allows a local attacker to cause a denial of service via a crafted FUTEX_WAIT_REQUEUE_PI command resulting in a NULL pointer dereference and syste...

CVE-2013-4591

CVE-2013-4591 is a Linux kernel vulnerability affecting the nfs4 ACL path: a buffer overflow in __nfs4_get_acl_uncached within fs/nfs/nfs4proc.c, fixed in kernel 3.7.2. Versions before 3.7.2 are vulnerable to local memory corruption leading to denial of service (memory corruption and system crash...

CVE-2014-0203

CVE-2014-0203 affects the Linux kernel up to version 2.6.32.x, where the __do_follow_link function in fs/namei.c mishandles the last pathname component for certain filesystems, enabling a local attacker to trigger a denial of service (incorrect free operations and system crash) via an open() call...

CVE-2014-1444

Technical details beyond the Initial Description are not publicly provided in the connected documents. Monitor for updates from upstream advisories to confirm affected products, versions, and fixes.

CVE-2014-5206

CVE-2014-5206 : In Linux kernel versions up to 3.16.1, the do_remount function in fs/namespace.c fails to preserve the MNT_LOCK_READONLY flag across remounts of bind mounts. This allows a local user to bypass the intended read-only restriction by using a mount -o remount within a user namespace, ...

CVE-2015-7312

CVE-2015-7312 affects the Linux kernel 3.x/4.x via race conditions in the aufs aufs3-mmap.patch and aufs4-mmap.patch patches. The vulnerability allows local users to cause denial of service (use-after-free/BUG) or potentially gain privileges through madvise or msync calls, related to mm/madvise.c...

CVE-2015-8966

CVE-2015-8966 affects the Linux kernel — specifically arch/arm/kernel/sys_oabi-compat.c — where, in versions before 4.4, a local user can gain privileges by crafting an fcntl64 call (F_OFD_GETLK, F_OFD_SETLK, or F_OFD_SETLKW). The connected Nessus advisories corroborate the kernel file and vulner...

CVE-2016-10318

The CVE-2016-10318 issue affects the Linux kernel’s ext4 and f2fs filesystem encryption support (fs/crypto/policy.c). It is caused by a missing authorization check in fscrypt_process_policy, allowing a user to assign an encryption policy to a directory owned by another user, which can lead to a d...

CVE-2016-10723

CVE-2016-10723 affects the Linux kernel up to version 4.17.2. The issue is in the page allocator: it does not yield CPU resources to the owner of the oom_lock mutex, allowing a local unprivileged user to trap the system in a busy loop by wasting CPU time during oom-killer invocation. The root cau...

CVE-2016-2085

CVE-2016-2085 : The Linux kernel (before 4.5) contains an info leak/vulnerability in evm_verify_hmac in security/integrity/evm/evm_main.c, where improper data copy enables local users to forge MAC values via a timing side-channel attack. Affected: Linux kernel up to version 4.4.x (prior to 4.5). ...

CVE-2016-6787

CVE-2016-6787 affects the Linux kernel’s performance subsystem: kernel/events/core.c before 4.0 mismanages locks during certain migrations, allowing local users to gain privileges via a crafted application (Android internal bug 31095224). Impact is local privilege escalation with complete confide...

CVE-2018-14641

CVE-2018-14641 is a Linux kernel vulnerability affecting versions 4.19-rc1 through 4.19-rc3, with the flaw located in ip_frag_reasm() (net/ipv4/ip_fragment.c). Under certain non-default but not rare configurations on a victim host, an attacker can remotely trigger a crash in ip_do_fragment(), pro...

CVE-2020-15852

CVE-2020-15852 affects Linux kernel 5.5–5.7.9 (and Xen via 4.13.x for x86 PV guests). The issue stems from mishandling of tss_invalidate_io_bitmap, causing desynchronization between TSS I/O bitmaps and Xen, which may let an attacker gain I/O port permissions of an unrelated task. Public advisorie...

CVE-2021-4454

CVE-2021-4454 affects the Linux kernel CAN/J1939 subsystem. In concurrent paths, j1939_session_deactivate() can be invoked with a session ref-count

CVE-2021-47062

The CVE-2021-47062 vulnerability affects the Linux kernel KVM SVM path. The issue occurs when iterating vCPUs for SEV-encrypted VMSAs using created_vcpus, which does not guarantee a vCPU’s existence and can trigger a NULL pointer dereference. The documented fix switches to iterating with online_v...

CVE-2021-47123

CVE-2021-47123 concerns a Linux kernel use-after-free risk caused by an io_uring timeout path: a double free can occur if a linked timeout is not removed from the master request link list, potentially leading to use-after-free scenarios. The description states the fix is to always remove linked t...

CVE-2021-47314

CVE-2021-47314 refers to a Linux kernel issue in the fsl_ifc memory handling: on probe failure the driver could leak private memory. The connected Astra/OpenVAS/Nessus advisories reproduce that the fix was to switch to resource-managed allocation to free memory when probe errors occur, mitigating...

CVE-2021-47381

The CVE-2021-47381 vulnerability is addressed in the Linux kernel under the ASoC: SOF component. The issue involved the DSP oops stack dump output contents, with the fix targeting the @buf argument passed to hex_dump_to_buffer() and the stack address used in the dump error output. The patch preve...

CVE-2021-47419

CVE-2021-47419 affects Linux kernel net/sched sch_taprio. A timer is set before a packet arrives and may not be canceled if ops->reset is not invoked; the fix cancels the timer in taprio_destroy (destroy path). Connected docs specify the root cause (timer scheduled before packet processing) an...

CVE-2021-47424

The CVE-2021-47424 issue affects the Linux kernel i40e driver. When VSI setup fails during PF switch in i40e_probe(), the code attempted to free misc IRQ vectors in i40e_clear_interrupt_scheme, potentially freeing an IRQ that had not been allocated yet, leading to a kernel Oops (example trace sho...

CVE-2021-47442

The CVE-2021-47442 issue affects the Linux kernel NFC digital path. The vulnerability arises because skb is allocated in digital_in_send_sdd_req() but is not freed when digital_in_send_cmd() fails, leading to a memory leak. The fix is to free skb if digital_in_send_cmd() returns a failure. Report...

CVE-2021-47499

CVE-2021-47499 – Linux kernel, iio: accel: kxcjk-1013 : The issue was a memory leak in the probe path for iio_triggered_buffer_setup, caused when ACPI type is ACPI_SMO8500 and data->dready_trig was not set, preventing freeing of allocated memory. The root cause is the probe-path logic leaving ...

CVE-2021-47583

CVE-2021-47583 affects the Linux kernel’s media/mxl111sf driver. Syzbot reported an uninitialized mutex in mxl111sf_ctrl_msg() due to the previous mutex_init(&state->msg_lock) being called too late. The order of dvb_usbv2_init() calls meant mxl111sf_ctrl_msg() could run from frontend_attach be...

CVE-2021-47587

Affected software: Linux kernel driver path related to net: systemport and descriptor lifecycle handling (descriptor list across transmit queues). Vulnerability and root cause: The descriptor lifecyle was not globally serialized across all TX queues; the existing locking only protected concurrenc...

CVE-2021-47597

CVE-2021-47597 affects the Linux kernel inet_diag path handling UDP sockets. The root cause is that UDP paths did not initialize r->idiag_expires in inet_sk_diag_fill(), enabling kernel-infoleak reports observed by KMSAN. The provided connected advisories describe a chain of in-kernel data flo...

CVE-2022-48710

CVE-2022-48710 concerns the Linux kernel Radeon driver. Inradeon_fp_native_mode() , the code assigns the return ofdrm_mode_duplicate() to a mode pointer and may dereference a NULL on failure. The issue is resolved by adding a NULL-pointer check to avoid NP: when drm_mode_duplicate() fails, and th...

CVE-2022-48824

CVE-2022-48824 : In the Linux kernel, the scsi myrs driver can crash during error handling. If privdata->hw_init() fails non‑zero, myrs_detect() leaves cs->disable_intr as NULL and myrs_cleanup() dereferences a NULL pointer, causing a kernel crash with a NULL pointer dereference. The issue ...

CVE-2022-48865

CVE-2022-48865 affects the Linux kernel TIPc bearer path; root cause is a race where monitoring data is not yet allocated when a bearer is enabled, leading to a NULL pointer dereference (mon->dom_gen) during tipc_mon_prep(). The issue was fixed by allocating the monitoring data before enabling...

CVE-2022-48972

CVE-2022-48972 affects the Linux kernel’s mac802154 code path. The issue arises in ieee802154_if_add() where a wpan_dev private data structure’s list is not initialized, potentially leading to a NULL pointer dereference during notifier handling (cfg802154_netdev_notifier_call) as devices are regi...

CVE-2022-49126

CVE-2022-49126 concerns the Linux kernel component scsi/mpi3mr. The issue is described as memory leaks in the operational reply queue’s memory segments that are not freed when unloading the driver. The entry states a fix for these leaks has been implemented. No exploitation details are provided i...

CVE-2022-49128

The CVE concerns the Linux kernel DRM bridge PM runtime: calling pm_runtime_get_sync() could increment the runtime PM counter even on error, risking a refcount leak. The provided fix replaces this API with pm_runtime_resume_and_get() (which does not change the runtime PM counter on error) and add...