CVE-2008-4576

CVE-2008-4576 affects the Linux kernel SCTP implementation prior to 2.6.25.18. A remote attacker can trigger a denial of service by sending an INIT-ACK that states the peer does not support AUTH, causing sctp_process_init to clean up active transports and, when the T1-Init timer expires, to trigg...

CVE-2007-5093

The CVE-2007-5093 issue affects the Linux kernel pwc (Philips USB Webcam) driver in 2.6.x up to 2.6.22.5, where disconnect relies on user space to close the device. This can allow a user-assisted local attacker to cause a denial of service (USB subsystem hang and khubd CPU usage) by not closing t...

CVE-2008-3831

The CVE-2008-3831 entry concerns the i915 DRM driver in Linux kernel 2.6.24 (notable on Debian GNU/Linux) and OpenBSD. The root cause is that the DRM_I915_HWS_ADDR ioctl is not restricted to the DRM master due to the absence of the DRM_MASTER and DRM_ROOT_ONLY flags in the ioctl configuration. Th...

CVE-2009-0322

CVE-2009-0322 affects the Linux kernel Dell RBU (Remote BIOS Update) driver: reading zero bytes from image_type or packet_size under /sys/devices/platform/dell_rbu/ can cause a local DoS (system crash). Concrete references in connected advisories show affected kernels include 2.6.27.x (before 2.6...

CVE-2009-0778

CVE-2009-0778 affects the Linux kernel prior to 2.6.25 when configured as a router with a REJECT route. The icmp_send code in net/ipv4/icmp.c can mishandle the Protocol Independent Destination (DST) cache, potentially leaking DST state and allowing remote attackers to cause a denial of service (c...

CVE-2009-1897

The CVE affects the Linux kernel tun/tun_chr_poll path: the tun_chr_poll function in drivers/net/tun.c for Linux kernel versions 2.6.30 and 2.6.30.1. The underlying issue is that, when the -fno-delete-null-pointer-checks option is omitted, a NULL pointer dereference can be triggered via a NULL de...

CVE-2012-4565

CVE-2012-4565 affects the Linux kernel up to version 3.4.18 (pre-3.4.19) in tcp_illinois_info within net/ipv4/tcp_illinois.c. When net.ipv4.tcp_congestion_control illinois is enabled, local users can trigger a divide-by-zero OOPS by reading TCP stats, causing denial of service. Mitigation is to u...

CVE-2014-9428

CVE-2014-9428 affects the Linux kernel’s B.A.T.M.A.N. fragmentation code (batadv_frag_merge_packets in net/batman-adv/fragmentation.c) up to version 3.18.1, where an incorrect length field in a memory calculation can be exploited by remote attackers to cause a denial of service (mesh-node system ...

CVE-2015-5706

CVE-2015-5706 is a local-use-after-free vulnerability in the Linux kernel (path_openat in fs/namei.c) affecting 3.x and 4.x before 4.0.4. An attacker can trigger a denial of service (and possibly other impact) via O_TMPFILE filesystem operations that leverage a duplicate cleanup operation. Remedi...

CVE-2015-6526

CVE-2015-6526 affects the Linux kernel on ppc64 where perf_callchain_user_64 can enter an infinite loop due to a deep 64-bit userspace backtrace. The evidence points to Linux kernel versions before 4.0.2 (fixed in 4.0.2) and local DoS via a crafted backtrace. Affected component: arch/powerpc/perf...

CVE-2015-7509

Summary (CVE-2015-7509 + related advisory) The issue affects the Linux kernel’s ext4/namei.c logic for non-journal filesystems. In kernels before 3.7.3, the ext4_orphan_del/ orphan-list handling can be bypassed by crafted filesystems, allowing physically proximate attackers to trigger a denial of...

CVE-2015-8966

CVE-2015-8966 affects the Linux kernel — specifically arch/arm/kernel/sys_oabi-compat.c — where, in versions before 4.4, a local user can gain privileges by crafting an fcntl64 call (F_OFD_GETLK, F_OFD_SETLK, or F_OFD_SETLKW). The connected Nessus advisories corroborate the kernel file and vulner...

CVE-2016-10723

CVE-2016-10723 affects the Linux kernel up to version 4.17.2. The issue is in the page allocator: it does not yield CPU resources to the owner of the oom_lock mutex, allowing a local unprivileged user to trap the system in a busy loop by wasting CPU time during oom-killer invocation. The root cau...

CVE-2016-2085

CVE-2016-2085 : The Linux kernel (before 4.5) contains an info leak/vulnerability in evm_verify_hmac in security/integrity/evm/evm_main.c, where improper data copy enables local users to forge MAC values via a timing side-channel attack. Affected: Linux kernel up to version 4.4.x (prior to 4.5). ...

CVE-2017-17857

The CVE-2017-17857 vulnerability affects the Linux kernel’s verifier.c check_stack_boundary in versions up to 4.14.8, allowing local users to trigger memory corruption and potential denial of service or other impact by mishandling invalid variable stack read operations. Connected advisories (Unit...

CVE-2018-14641

CVE-2018-14641 is a Linux kernel vulnerability affecting versions 4.19-rc1 through 4.19-rc3, with the flaw located in ip_frag_reasm() (net/ipv4/ip_fragment.c). Under certain non-default but not rare configurations on a victim host, an attacker can remotely trigger a crash in ip_do_fragment(), pro...

CVE-2018-6412

CVE-2018-6412 affects the Linux kernel sbusfb_ioctl_helper() in drivers/video/fbdev/sbuslib.c up to and including 4.15. It introduces an integer signedness error that could allow an attacker to leak arbitrary information via the FBIOPUTCMAP_SPARC and FBIOGETCMAP_SPARC ioctls, impacting confidenti...

CVE-2019-18812

CVE-2019-18812 corresponds to a memory-leak vulnerability in the Linux kernel’s sof_dfsentry_write() (sound/soc/sof/debug.c). The issue, present in kernel builds up to 5.3.9, can be exploited to cause a denial of service via memory consumption. The connected Nessus advisories (Unity Linux UTSA-20...

CVE-2021-47007

CVE-2021-47007 affects the Linux kernel’s f2fs resizing path. The issue occurs in f2fs_resize_fs() when resizing a 16GB image to 8GB, where the allocator may run out of space during block migration because the code did not verify there is enough free space to store blocks before resizing. This ca...

CVE-2021-47114

A vulnerability in the Linux kernel 's ocfs2 filesystem allows for data corruption during the fallocate operation. The issue arises when fallocate punches holes out of an inode size where the original size is in the middle of the last cluster; the remaining part of the cluster is zeroed via buffe...

CVE-2021-47249

CVE-2021-47249 concerns a memory-leak in the Linux kernel’s net: rds path, fixed by correcting refcount handling in rds_recvmsg. The issue occurred when an error happened in rds_cmsg_recv(): after a successful rds_next_incoming(rs, &inc) the code would increment inc’s refcount, but on failure to ...

CVE-2021-47325

CVE-2021-47325 concerns the Linux kernel’s iommu/arm-smmu subsystem. The issue is a refcount leak in arm_smmu_iova_to_phys_hard() where, on several error paths, the refcount of the underlying smmu object, increased by arm_smmu_rpm_get(), is not decremented. The fixed workaround described in the p...

CVE-2021-47327

The Linux kernel contains a reference counting vulnerability in the iommu/arm-smmu driver (specifically the arm_smmu_device refcount). The root cause is that the arm_smmu_rpm_get() function invokes pm_runtime_get_sync(), which increments the "smmu" refcount even when the return value is less than...

CVE-2021-47376

CVE-2021-47376 is a Linux kernel issue where an oversize allocation in kmalloc path could trigger a warning during BPF verification. The provided description and connected advisories indicate the fix adds an oversize check before kvcalloc() via the commit that introduces the guard in mm/kvmalloc(...

CVE-2021-47421

CVE-2021-47421 affects the Linux kernel amdgpu driver. The root cause is that during PCI error handling, the code may release a write lock in amdgpu_pci_resume even when not safely holding it, leading to potential deadlocks when other threads acquire a read lock. The fix, documented across connec...

CVE-2021-47442

The CVE-2021-47442 issue affects the Linux kernel NFC digital path. The vulnerability arises because skb is allocated in digital_in_send_sdd_req() but is not freed when digital_in_send_cmd() fails, leading to a memory leak. The fix is to free skb if digital_in_send_cmd() returns a failure. Report...

CVE-2021-47479

The CVE-2021-47479 entry concerns the Linux kernel staging driver rtl8712 (rtl8712_dl_fw) with a use-after-free caused by a race between r871xu_dev_remove() and the ndo_open() callback. The issue arises when firmware is freed before the network device is unregistered, allowing the driver to acces...

CVE-2021-47500

The CVE-2021-47500 issue affects the Linux kernel IIO mma8452 driver. The driver assigned a trigger to the IIO device without first obtaining a reference, which allowed the trigger to be freed during use and caused a use-after-free. The documented fix is to obtain a reference to the trigger befor...

CVE-2021-47587

Affected software: Linux kernel driver path related to net: systemport and descriptor lifecycle handling (descriptor list across transmit queues). Vulnerability and root cause: The descriptor lifecyle was not globally serialized across all TX queues; the existing locking only protected concurrenc...

CVE-2021-47636

CVE-2021-47636 relates to the Linux kernel ubifs_wbuf_write_nolock() reading beyond buf bounds, causing a slab-out-of-bounds read in KASAN/ubifs paths. The vulnerability arises when len is not 8-byte aligned and the function writes via ubifs_leb_write(), potentially reading past the end of the bu...

CVE-2021-47637

CVE-2021-47637: In the Linux kernel ubifs deadlock during concurrent rename whiteout and inode writeback. Root cause is a deadlock between the ui_mutex held during ubifs_write_inode/lock and the whiteout budget path, causing hung tasks in writeback and rename code (rename_whiteout → ubifs_rename ...

CVE-2022-48653

CVE-2022-48653 relates to the Linux kernel ice driver. The vulnerability arises from a double unplug of aux devices in the IDC callback (triggered when aux drivers request a reset and again in ice_prepare_for_reset), causing a scheduling while atomic BUG. The effect is a kernel panic/BUG rather t...

CVE-2022-48710

CVE-2022-48710 concerns the Linux kernel Radeon driver. Inradeon_fp_native_mode() , the code assigns the return ofdrm_mode_duplicate() to a mode pointer and may dereference a NULL on failure. The issue is resolved by adding a NULL-pointer check to avoid NP: when drm_mode_duplicate() fails, and th...

CVE-2022-48761

The Linux kernel contains a vulnerability in the xhci-plat component that causes a crash on the i.mx8qm platform when suspending with remote wake enabled. The root cause is that xhci_suspend gates the clock of parent devices, but a subsequent call to xhci_disable_hub_port_wake attempts to access ...

CVE-2022-48865

CVE-2022-48865 affects the Linux kernel TIPc bearer path; root cause is a race where monitoring data is not yet allocated when a bearer is enabled, leading to a NULL pointer dereference (mon->dom_gen) during tipc_mon_prep(). The issue was fixed by allocating the monitoring data before enabling...

CVE-2022-49061

The CVE-2022-49061 issue affects the Linux kernel net: ethernet: stmmac altr_tse_pcs when using a fixed-link. The driver crashes with a null-pointer dereference because phy_device is not provided to tse_pcs_fix_mac_speed. The patch adds a check for phy_dev before calling tse_pcs_fix_mac_speed() a...

CVE-2022-49126

CVE-2022-49126 concerns the Linux kernel component scsi/mpi3mr. The issue is described as memory leaks in the operational reply queue’s memory segments that are not freed when unloading the driver. The entry states a fix for these leaks has been implemented. No exploitation details are provided i...

CVE-2022-49193

CVE-2022-49193 concerns the Linux kernel ice driver: a scheduling-while-atomic bug during aux critical error interrupt in ice_misc_intr() could lead to an oops via a mutex lock path. The fixed sequence adds handling in process context (ice_service_task) and introduces a PF state bit (oicr_err_reg...

CVE-2022-49194

The CVE-2022-49194 issue affects the Linux kernel BCMGENET ethernet driver (net/bcmgenet) where GCC12’s relaxed memory access optimization can reorder register reads/writes. This undermines the assumed non-reordering of device memory and the barriers provided by other constructs (e.g., spinlocks)...

CVE-2022-49224

CVE-2022-49224 affects the Linux kernel in the power: supply: ab8500 module, where a memory leak can occur because kobject_init_and_add() may fail and memory is not released. The fix is to call kobject_put() on error to properly clean up, as documented in the vulnerability description. The issue ...

CVE-2022-49251

The CVE-2022-49251 entry refers to a Linux kernel vulnerability in ASoC: codecs: va-macro where accessing enums via integers could trigger array bounds access on aarch64 (where long is 8 bytes vs a 4-byte enum). The connected Astra/SUSE OSV entries reiterate the same vulnerability and indicate a ...

CVE-2022-49269

The CVE-2022-49269 issue affects the Linux kernel CAN subsystem: isotp_bind() incorrectly validates CAN IDs, allowing a state machine path that can be reached with non-standard IDs (ex: 0x6000001 and 0xC28001) that map to 11-bit IDs 0x001. The fix sanitizes SFF/EFF CAN ID values before address ch...

CVE-2022-49382

CVE-2022-49382 affects the Linux kernel: soc: rockchip: Fix refcount leak in rockchip_grf_init. The issue occurred because of_find_matching_node_and_match returns a node pointer with an incremented refcount, and the patch adds missing of_node_put() when done to avoid the leak. Connected Astra Lin...

CVE-2022-49490

CVE-2022-49490: In the Linux kernel, drm/msm/mdp5 had a NULL dereference risk in mdp5_pipe_release when mdp5_get_global_state could return an error (-EDEADLK) during modeset lock handling. The fix propagates such errors from mdp5_get_global_state to mdp5_pipe_release and returns a proper error in...

CVE-2022-49613

CVE-2022-49613 affects the Linux kernel serial driver 8250 console handover. When a console is enabled, univ8250_console_setup() runs before .dev is bound to the uart_port, so pm_runtime_get_sync() is skipped. Later, during handover, serial8250_console_exit() may call pm_runtime_put_sync() with a...

CVE-2022-49794

CVE-2022-49794 affects the Linux kernel IIO ADC driver (iio: adc: at91_adc). The issue is a potential memory leak in at91_adc_allocate_trigger where, if iio_trigger_register() returns an error, the driver should free the trigger reference via iio_trigger_free() and then release memory with iio_tr...

CVE-2022-49803

CVE-2022-49803 relates to the Linux kernel netdevsim memory leak in nsim_dev->fa_cookie. The issue arises when nsim_dev_trap_fa_cookie_write() allocates fa_cookie with kmalloc and assigns it to nsim_dev->fa_cookie, but nsim_drv_remove() fails to free it, leading to a leak reported by kmemle...

CVE-2022-49958

Summary: CVE-2022-49958 affects the Linux kernel net/sched subsystem. When an ethernet device with multiple queues fails to attach a qdisc to queue 0 due to memory exhaustion, the code may leave the original qdisc attached on other queues and fall back to noqueue, causing a reference leak if the ...

CVE-2022-50033

CVE-2022-50033: In the Linux kernel USB host OHCI PPC OF driver, of_find_compatible_node() may return a node with an incremented refcount and of_node_put() must be used when not needed. The issue is a refcount leak in ohci_hcd_ppc_of_probe(). Affected: Linux kernel (ohci-ppc-of path). Impact is a...

CVE-2022-50069

CVE-2022-50069 concerns the Linux kernel BPF subsystem. The root cause is that bpf_sys_bpf() may copy instruction data from a kernel address (via bpfptr_t) without validating it, since copy_from_bpfptr() can dereference in-kernel pointers. This can lead to a use-after-free/invalid dereference in ...