CVE-2016-3135

CVE-2016-3135 is an integer overflow in xt_alloc_table_info (net/netfilter/x_tables.c) of the Linux kernel up to 4.5.2 on 32-bit platforms, enabling local privilege escalation or heap corruption leading to DoS via IPT_SO_SET_REPLACE. Connected documents corroborate the 32-bit overflow in xt_alloc...

CVE-2024-49984

CVE-2024-49984 : In the Linux kernel DRM/V3D, there was an out-of-bounds access bug in the performance query extensions. The issue arises from copying IDs when validating the number of perfmon userspace inputs for the copy and reset extensions; the kernel did not adequately bound-check the destin...

CVE-2024-53182

The CVE-2024-53182 issue affects the Linux kernel BFQ Scheduler. A revert of the patch that merged bfq_release_process_ref() into bfq_put_cooperator() caused bic_set_bfqq to operate on a freed bic data structure, yielding a slab-use-after-free detected by KASAN in bic_set_bfqq+0x200/0x230. Impact...

CVE-2024-58082

CVE-2024-58082 affects the Linux kernel media nuvoton driver (npcm_video_ece_init). The root cause is improper error handling: when of_find_device_by_node() fails it returns NULL instead of an error code, so the code path should check for NULL and return -ENODEV. The fix implements proper NULL ch...

CVE-2025-21817

The CVE-2025-21817 entry concerns the Linux kernel block subsystem: GFP_NOIO is now required around sysfs ->store() to prevent potential deadlock when sysfs->store callbacks allocate memory via GFP_KERNEL during direct reclaim. This vulnerability vector arises from GFP_KERNEL allocations ta...

CVE-2025-21949

The CVE-2025-21949 entries describe a LoongArch-specific Linux kernel flaw where the base address for hugetlb mmap is not aligned with the pmd size. The issue manifests in the hugetlb handling path (mm/hugetlb.c) and affected scenario involves the test case testcases/bin/hugefork02, where a kerne...

CVE-2025-22100

CVE-2025-22100 corresponds to a Linux kernel race condition in the DRM Panthor driver (panthor_fdinfo_gather_group_samples). The root cause was a failure to protect group access with an xarray lock, which could lead to use-after-free. The issue is addressed by the patch in commit e16635d88fa0 (dr...

CVE-2025-23154

CVE-2025-23154 concerns the Linux kernel’s io_uring path. The issue arises from io_req_post_cqe being used for non-multishot requests, enabling abuse via a send bundle in io_uring/net. The fix adds a flag to indicate whether a request will post multiple CQEs; multishot (REQ_F_APOLL_MULTISHOT) sem...

CVE-2025-37751

The CVE affects the Linux kernel x86 CPU code. It arises from removing the NULL terminator at the end of the AMD erratum table during the switch from x86_cpu_desc to x86_cpu_id, causing readers to read past the end of the array. The fixed behavior is to replace the NULL terminator. Connected sour...

CVE-2025-37763

CVE-2025-37763 : In the Linux kernel, the drm/imagination code fixed a use-after-free in the GPU scheduling path (pvr_queue_prepare_job) by having the fragment job take a reference on the geometry job, preventing the geometry job from being freed until the fragment is done. This mitigates a slab-...

CVE-2025-37876

Summary (CVE-2025-37876) The Linux kernel netfs code creates /proc/fs/netfs unconditionally; when CONFIG_NETFS_SUPPORTS=y and CONFIG_PROC_FS is disabled, this can trigger a kernel crash. The connected documents indicate the root cause is in netfs_init(), where proc_mmkdir is invoked without guard...

CVE-2025-37951

CVE-2025-37951 affects the Linux kernel DRM/V3D path. When a CL/CSD job times out, if the GPU progressed, the kernel may skip the reset, keeping the job running; however, timedout_job() removes the job from the pending list, so it may not be freed, causing a memory leak. A patch adds the job back...

CVE-2025-38118

CVE-2025-38118 affects the Linux kernel Bluetooth MGMT subsystem. The flaw is a use-after-free in mgmt_remove_adv_monitor_complete (MGMT_OP_REMOVE_ADV_MONITOR path) caused by using mgmt_pending_add, leading to KASAN crashes. The issue is resolved by reworking MGMT_OP_REMOVE_ADV_MONITOR to avoid m...

CVE-2025-38163

CVE-2025-38163: A fault in the Linux kernel’s F2FS truncation path caused a kernel BUG due to an inconsistent sbi->total_valid_block_count versus mapped blocks, potentially leading to a crash/denial of service. The issue is in f2fs: with sbi->total_valid_block_count not matching inode-index...

CVE-2025-38174

CVE-2025-38174 affects the Linux kernel Thunderbolt configuration path. The issue occurs in tb_cfg_request_dequeue() where a request could be dequeued twice (triggered via frame.callback and tb_cfg_request()), risking a double list_del in ctl->request_queue and a general protection fault due t...

CVE-2025-38193

CVE-2025-38193 affects the Linux kernel net_sched SFQ (sch_sfq). The issue is a missing range check on perturb_period, which can enable a race condition; patches fix perturb_period overflow/invalid values. Public demonstrations show negative, oversized, and a valid perturb value (2000000), with t...

CVE-2025-38206

CVE-2025-38206 concerns the Linux kernel exfat subsystem, where a double free could occur in the delayed_free pathway during exfat_kill_sb() via exfat_free_upcase_table(). The vulnerability arises when freeing vol_utbl twice due to an error return path in exfat_create_upcase_table() leading to a ...

CVE-2025-38332

CVE-2025-38332 (Linux kernel) affects the lpfc SCSI path where BIOSVersion handling could panic due to a misused strlcat/FORTIFY check. The root cause is improper assumptions about buffer sizes, leading to a likely false positive overflow check, and the fix replaces the problematic sequence with ...

CVE-2025-38334

In CVE-2025-38334, the Linux kernel SGX path could reclaim EPC pages that are poisoned. Root cause: epc_page->poison is set during memory failure but the reclaimer logic does not check it, so poisoned EPC pages could be reclaimed and written out with EWB microcode operations, risking enclosure...

CVE-2025-38336

The CVE is a Linux kernel issue (CVE-2025-38336) affecting ata: pata_via when using ATAPI devices on VT6415/VT6330. The vulnerability stems from a hardware bug in the VIA controller that can cause a hard hang of the system during ATAPI DMAs, with potential boot-time failure depending on the attac...

CVE-2025-38393

CVE-2025-38393 is a Linux kernel race condition in NFSv4/pNFS wake logic for NFS_LAYOUT_DRAIN in pnfs_update_layout(). The issue occurs when a waiter and waker race, causing writeback/page lock hang; a barrier-based fix is applied. Public advisories/DB entries confirm the fix across multiple kern...

CVE-2025-38395

CVE-2025-38395 involves the Linux kernel regulator GPIO driver. The root cause is an out-of-bounds access in drvdata::gpiods because memory was allocated for only one pointer, while config::ngpios can exceed 1. The vulnerability can occur when more than one GPIO descriptor is configured. The fix ...

CVE-2025-38401

The CVE-2025-38401 issue affects the Linux kernel’s mtk-sd driver, where a DMA map failure in msdc_prepare_data() could lead to memory corruption if data DMA is started with stale settings. The vulnerability’s description and related advisories (including Debian LTS DLA entries and Amazon Linux A...

CVE-2025-38476

Mode C: The CVE-2025-38476 entry concerns a use-after-free in the Linux kernel’s rpl_do_srh_inline function (IPv6 RPL handling). The issue arises from accessing ipv6_hdr(skb) after skb_cow_head(), which could free the header. The fix converts the header reference to a local struct (oldhdr) instea...

CVE-2026-43494

CVE-2026-43494 affects the Linux kernel’s net/rds zerocopy path. When iov_iter_get_pages2() fails in rds_message_zcopy_from_user(), pinned pages are released and rm->data.op_mmp_znotifier is cleared, but rm->data.op_nents may not be reset. This leads to the cleanup loop in rds_message_purge...

CVE-2026-46319

The CVE-2026-46319 entry describes a race in the Linux kernel net/sched act_ct where rcu_read_lock is exited before refcount_inc_not_zero on ct_ft, allowing a UAF when ct_ft is freed during cleanup. This creates a local privilege-escalation risk as an attacker could observe or trigger the race wi...

CVE-2003-0961

CVE-2003-0961: An integer overflow in the Linux kernel do_brk function (brk syscall) affects Linux kernels 2.4.22 and earlier, enabling local users to gain root privileges. The description notes local privilege escalation but the supplied documents do not publish a specific fixed version patch or...

CVE-2003-0984

CVE-2003-0984 affects the Linux kernel RTC code: RTC routines in kernel 2.4.23 and earlier do not properly initialize their structures, which could leak kernel data to user space. Exploitation would require local access (per CVSS data), with partial impact on confidentiality, integrity, and avail...

CVE-2005-0001

CVE-2005-0001 describes a race condition in the Linux kernel page fault handler (fault.c) that affects multiprocessor systems. Affected kernel lines include 2.2.x to 2.2.7, 2.4 up to 2.4.29, and 2.6 up to 2.6.10. The vulnerability enables local attackers to execute arbitrary code by exploiting co...

CVE-2006-4145

CVE-2006-4145 affects the Linux kernel UDF filesystem driver (2.6.17 and earlier). The issue allows a local user to trigger a hang or crash by performing operations on truncated files (illustrated via dd). Public documents in connected feeds confirm this CVE and indicate that updated kernel packa...

CVE-2006-4997

CVE-2006-4997 involves the Linux kernel ATM subsystem (clip_mkip in net/atm/clip.c). The issue allows a remote attacker to trigger a denial of service (panic) by causing the ATM subsystem to dereference memory of socket buffers after they have been freed. This is triggered by memory access patter...

CVE-2006-5619

The CVE-2006-5619 issue is a Linux kernel 2.6.x vulnerability (up to 2.6.18-stable) where the /proc/net/ip6_flowlabel path handling can trigger an infinite loop while searching for flowlabels, allowing local users to cause a denial of service (hang or oops). Affected components are the ip6_fl_get...

CVE-2007-3843

The CVE-2007-3843 issue affects the Linux kernel (pre-2.6.23-rc1) CIFS handling: the mount option sec= is checked against the wrong global variable, which could allow remote attackers to spoof CIFS network traffic intended to be signed with security signatures (e.g., lack of signing despite sec=n...

CVE-2007-6151

CVE-2007-6151 affects the Linux kernel ISDN subsystem (ISDN ioctl path). The description in the Initial document states a local user can trigger a denial-of-service via a crafted ioctl struct where iocts is not null-terminated, causing a buffer overflow in isdn_common.c. Connected documents (RHSA...

CVE-2007-6762

The vulnerability is in the Linux kernel before 2.6.20, caused by an off-by-one error in net/netlabel/netlabel_cipso_v4.c that can overflow the doi_def->tags[] array. Affected component is the kernel’s netlabel CipSO v4 handling. The provided connected sources confirm the off-by-one overflow c...

CVE-2011-1493

CVE-2011-1493 affects the Linux kernel (before 2.6.39). The vulnerable code is in rose_parse_national (net/rose/rose_subr.c), where an array index error can be triggered by a FAC_NATIONAL_DIGIS entry that specifies many digipeaters. This can cause heap memory corruption and a remote denial of ser...

CVE-2012-6549

The CVE-2012-6549 entry concerns the Linux kernel vulnerability where isofs_export_encode_fh in fs/isofs/export.c did not initialize a structure member, allowing local attackers to read sensitive data from kernel heap memory via a crafted application. Affected: Linux kernel versions prior to 3.6....

CVE-2013-0216

CVE-2013-0216 refers to the Xen netback vulnerability in the Linux kernel prior to 3.7.8. Guest OS users could trigger ring-pointer corruption to cause a denial of service (loop). The linked connected documents ( MiracleLinux AXSA-2013-452:04 and Unity Linux advisories) explicitly list CVE-2013-0...

CVE-2014-9410

The CVE-2014-9410 entry affects the MSM-VFE31 driver for the Linux kernel 3.x (as used in Qualcomm Innovation Center Android contributions). The vulnerability is in vfe31_proc_general, which does not validate a specific id value, enabling a local attacker to gain privileges or cause memory corrup...

CVE-2015-5327

CVE-2015-5327 affects the Linux kernel (4.3-rc1 and later); the flaw is an out-of-bounds memory read in x509_decode_time within x509_cert_parser.c. Impact is partially confidentiality (per CVSS2) and high confidentiality (per CVSS3); the issue is fixed by kernel patches (as noted in referenced ad...

CVE-2016-10150

CVE-2016-10150 is a use-after-free in kvm_ioctl_create_device (virt/kvm/kvm_main.c) of the Linux kernel before 4.8.13, allowing a local host user to crash the host or possibly gain privileges via crafted ioctl calls on /dev/kvm. The fix is provided in kernel version 4.8.13 and later; remediation ...

CVE-2017-14954

CVE-2017-14954 affects the Linux kernel: the waitid implementation in waitid.c? actually kernel/exit.c in the Linux kernel up to 4.13.4 accesses rusage data structures in unintended cases, enabling local users to obtain sensitive information and bypass the KASLR protection via a crafted system ca...

CVE-2017-6874

The CVE-2017-6874 entry corresponds to a Linux kernel race condition in kernel/ucount.c (through 4.10.2). The vulnerability allows local users to trigger a denial of service (use-after-free and system crash) via crafted system calls that affect the interaction between put_ucounts and get_ucounts....

CVE-2020-15852

CVE-2020-15852 affects Linux kernel 5.5–5.7.9 (and Xen via 4.13.x for x86 PV guests). The issue stems from mishandling of tss_invalidate_io_bitmap, causing desynchronization between TSS I/O bitmaps and Xen, which may let an attacker gain I/O port permissions of an unrelated task. Public advisorie...

CVE-2021-47091

CVE-2021-47091 affects the Linux kernel mac80211 component. Root cause: locking in ieee80211_start_ap error path where local channel context release wasn’t guaranteed to hold local->mtx, risking improper synchronization. The fix enforces holding local->mtx when releasing the channel context...

CVE-2021-47100

CVE-2021-47100 is a Linux kernel vulnerability that causes a use-after-free (UAF) during uninstall of ipmi_si and ipmi_msghandler modules, leading to kernel oops/panic. The issue occurs when rmmod ipmi_si is followed by ipmi_msghandler removal, triggering kref_put cleanup that schedules a work it...

CVE-2021-47123

CVE-2021-47123 concerns a Linux kernel use-after-free risk caused by an io_uring timeout path: a double free can occur if a linked timeout is not removed from the master request link list, potentially leading to use-after-free scenarios. The description states the fix is to always remove linked t...

CVE-2021-47143

CVE-2021-47143 affects the Linux kernel net/smc subsystem. The root cause was missing cleanup when a smcd_dev device_add() failed, leaving the device in smcd_dev_list and later freeing it, causing a corrupted list. The fix adds error handling to remove the device from the list on device_add() fai...

CVE-2021-47314

CVE-2021-47314 refers to a Linux kernel issue in the fsl_ifc memory handling: on probe failure the driver could leak private memory. The connected Astra/OpenVAS/Nessus advisories reproduce that the fix was to switch to resource-managed allocation to free memory when probe errors occur, mitigating...

CVE-2021-47355

CVE-2021-47355 relates to the Linux kernel ATM nicstar driver. The issue is a use-after-free in nicstar_cleanup() caused by removing a timer with del_timer() instead of del_timer_sync(), which may allow the timer handler to still run after the device removal. The fix ensures the timer finishes an...