CVE-2021-44733

CVE-2021-44733 is a use-after-free in the Linux kernel TEE subsystem (drivers/tee/tee_shm.c) that can occur during freeing of a shared memory object due to a race in tee_shm_get_from_id. Affects Linux kernels up to 5.15.11; exploitation could lead to denial of service and, in some configurations,...

CVE-2022-1462

CVE-2022-1462 is an out-of-bounds read in the Linux kernel TeleTYpe subsystem triggered by a race using ioctls (TIOCSPTLCK, TIOCGPTPEER, TIOCSTI, TCXONC). Local users can crash the system or read unauthorized memory. Public advisories link this CVE to Linux kernel versions across multiple distrib...

CVE-2019-19063

Concretely affected software: Linux kernel realtek rtlwifi USB driver (rtl_usb_probe in drivers/net/wireless/realtek/rtlwifi/usb.c). Root cause: two memory leaks in rtl_usb_probe() leading to memory exhaustion. Impact: potential denial of service due to unbounded memory consumption (through 5.3.1...

CVE-2026-46243

The CVE-2026-46243 entry concerns the Linux kernel CIFS client. It fixes a bug where cifs.spnego key descriptions could be created by userspace (via request_key(2) or add_key(2)) and include fields (pid, uid, creduid, upcall_target) that are treated as kernel-origin inputs. The fix restricts acce...

CVE-2018-17972

The CVE-2018-17972 issue affects the Linux kernel (proc_pid_stack in fs/proc/base.c) up to 4.18.11, where an attacker with local access could exploit race in stack unwinding to leak kernel task stack contents. The root cause is insufficient restriction on inspecting kernel stacks, enabling local ...

CVE-2019-5108

CVE-2019-5108 is an exploitable denial-of-service in the Linux kernel prior to mainline 5.3. An attacker can trigger IAPP location updates for stations before authentication completes by forging Authentication/Association Request packets, leading to potential CAM-table attacks or traffic flapping...

CVE-2019-13631

The CVE-2019-13631 entry describes a vulnerability in the Linux kernel (parse_hid_report_descriptor in drivers/input/tablet/gtco.c) where a malicious USB HID device can cause an out-of-bounds write during debugging message generation. This affects kernels up to version 5.2.1. The document does no...

CVE-2019-17055

CVE-2019-17055 affects the Linux kernel up to 5.3.2, where base_sock_create in drivers/isdn/mISDN/socket.c did not enforce CAP_NET_RAW, allowing unprivileged users to create a raw socket via AF_ISDN. The issue is tracked with CID CID-b91ee4aa2a21 and was addressed in upstream kernel commits 0edc3...

CVE-2021-3612

CVE-2021-3612 is an out-of-bounds memory write flaw in the Linux kernel joystick subsystem exploitable by a local user via the JSIOCSBTNMAP ioctl. The advisory notes potential system crash and possible privilege escalation. Affected disclosures reference pre-5.13.2 revisions (e.g., fixes upstream...

CVE-2023-3390

CVE-2023-3390 is a local-use-after-free vulnerability in Linux kernel nftables (net/netfilter/nf_tables_api.c) caused by mishandled NFT_MSG_NEWRULE error paths, enabling a local attacker with CAP_SYS_ADMIN to trigger a privilege escalation. Public advisories (Amazon Linux 2/ALAS, Astra Linux, Deb...

CVE-2020-8649

CVE-2020-8649 is a Linux kernel use-after-free in vgacon_invert_region (drivers/video/console/vgacon.c). The vulnerability, reported as CVE-2020-8649, could lead to memory corruption or DoS via the vgacon driver when a virtual terminal is accessed. Public details in Debian security advisories (DL...

CVE-2021-46920

CVE-2021-46920 concerns the Linux kernel DMAengine idxd; the bug is a clobber of the SWERR overflow bit during writeback where the code overwrites SWERR/OVERFLOW instead of restoring the bits read. Affected: Linux kernel with idxd component; root cause: writeback path writes read values back, pre...

CVE-2023-1859

CVE-2023-1859 is a use-after-free in Xen transport 9pfs (xen_9pfs_front_removet in net/9p/trans_xen.c) of the Linux kernel. Connected security bulletins confirm a race condition that could allow a local attacker to crash the system and potentially leak kernel information. Affected is the Xen 9pfs...

CVE-2023-35001

CVE-2023-35001 is a Linux kernel nftables vulnerability where the nft_byteorder expression mishandles vm register contents when CAP_NET_ADMIN exists in any user or network namespace, causing an out-of-bounds read/write in the nf_tables nft_byteorder path. Public references in the provided documen...

CVE-2019-15221

CVE-2019-15221 affects the Linux kernel up to version 5.1.17. A NULL pointer dereference can be triggered by a malicious USB device via the sound/usb/line6/pcm.c driver, leading to denial of service or system instability. Affected component is the kernel sound USB Line6 PCM driver; root cause is ...

CVE-2020-24586

CVE-2020-24586 describes a fragmentation cache issue in the Linux kernel Wi‑Fi stack: received fragments are not cleared from memory on reconnect, enabling an attacker within Wi‑Fi range to inject arbitrary packets or exfiltrate data when fragments encrypted with WEP/CCMP/GCMP are involved. Conne...

CVE-2023-34319

CVE-2023-34319 is a Linux kernel netback driver buffer overrun caused by an edge case where an entire packet is fragmented into the maximum pieces yet remains smaller than the area that preserves all headers together, after the XSA-423 fix. Exploitation could enable local denial-of-service or ins...

CVE-2021-43056

CVE-2021-43056 affects the Linux kernel for POWERPC (Power8) prior to 5.14.15. The root cause is a bug in arch/powerpc/kvm/book3s_hv_rmhandlers.S handling of SRR1 values, which can allow a malicious KVM guest to crash the host (availability impact). The issue is documented across multiple sources...

CVE-2023-6546

CVE-2023-6546 describes a race condition in the Linux kernel’s GSM 0710 tty multiplexor. Two threads can race on GSMIOC_SETCONF on the same tty when gsm line discipline is enabled, triggering a use-after-free of the gsm_dlci during GSM mux restart and potentially enabling local privilege escalati...

CVE-2020-12653

CVE-2020-12653 affects the Linux kernel prior to 5.5.4, caused by an incorrect memcpy in the mwifiex_cmd_append_vsie_tlv() function (drivers/net/wireless/marvell/mwifiex/scan.c). This enables a local attacker to gain elevated privileges or cause a denial of service due to a buffer overflow. Conne...

CVE-2021-46914

CVE-2021-46914 concerns the Linux kernel ixgbe driver, where suspend/resume code caused an unbalanced device enable/disable sequence. The root cause was a removal of pci_enable_device_mem() from ixgbe_resume(), which in combination with pci_disable_device() in __ixgbe_shutdown() could over- or un...

CVE-2021-46916

CVE-2021-46916 affects the ixgbe driver in the Linux kernel, where a NULL pointer dereference can occur during the ethtool loopback test due to a missing q_vector for the test ring. The fix adds a check for a q_vector and, if absent, returns a napi_id value of 0. This resolves a potential crash/D...

CVE-2022-27666

CVE-2022-27666 describes a heap buffer overflow in IPsec ESP transformation code (net/ipv4/esp4.c and net/ipv6/esp6.c) that can allow a local user to overwrite kernel heap objects and may lead to local privilege escalation. Connected advisories confirm kernel patches are available (e.g., AlmaLinu...

CVE-2019-11599

CVE-2019-11599 is a race-condition vulnerability in the Linux kernel’s core dump path that can leak data or cause DoS due to missing locking around vma layout/flags while core dumps run. Affected components include fs/userfaultfd.c, mm/mmap.c, fs/proc/task_mmu.c, and drivers/infiniband/core/uverb...

CVE-2020-10768

CVE-2020-10768 affects the Linux kernel prior to 5.8-rc1, where prctl() can re-enable indirect branch speculation after it has been disabled, enabling Spectre v2-style disclosure. The vulnerability has Local attack vector and primarily impacts confidentiality; no exploitation details are provided...

CVE-2020-13143

CVE-2020-13143 affects the Linux kernel USB gadget/configfs (drivers/usb/gadget/configfs.c) from 3.16 to 5.6.13. The flaw arises when gadget_dev_desc_UDC_store uses kstrdup and may encounter an internal NUL value, leading to potential out-of-bounds memory access (reported as heap out-of-bounds wr...

CVE-2023-3611

Consolidated details confirm CVE-2023-3611 affects the Linux kernel’s net/sched sch_qfq code. The vulnerability is an out-of-bounds write in qfq_change_agg where lmax is updated based on packet sizes without proper bounds checks, enabling local privilege escalation. The issue is triggered in sch_...

CVE-2019-12819

CVE-2019-12819 affects the Linux kernel (pre-5.0) where __mdiobus_register() in drivers/net/phy/mdio_bus.c calls put_device(), triggering a fixed_mdio_bus_init use-after-free and resulting in a denial of service. The connected Nessus/OpenVAS entries replicate this description and note local explo...

CVE-2019-14896

CVE-2019-14896 concerns a heap-based (and stack) overflow in the Marvell Libertus/Marvell network driver within the Linux kernel (lbs_ibss_join_existing path per initial doc; add_ie_rates in libertas CFG.c per IBM bulletin). Exploitation could enable remote code execution or cause a denial of ser...

CVE-2019-19523

CVE-2019-19523 affects the Linux kernel prior to 5.3.7, where a use-after-free can be caused by a malicious USB device via the drivers/usb/misc/adutux.c driver (CID-44efc269db79). Affected systems include distributions referenced in accompanying advisories (e.g., MiracleLinux 8, Unity Linux 20.x)...

CVE-2020-12351

CVE-2020-12351 corresponds to the Linux kernel Bluetooth vulnerability known as BleedingTooth. Exploitation involves Bluetooth L2CAP and related memory handling, with PoCs showing remote code execution from a nearby attacker. Root causes cited in public exploit data include a type-confusion error...

CVE-2022-42703

CVE-2022-42703 affects the Linux kernel prior to 5.19.7 via a use-after-free in leaf anon_vma double reuse in mm/rmap.c. This enables local escalation of privilege (per CVSS: LOCAL, HIGH availability impact, LOW complexity, no user interaction). Upstream fixes were applied in kernel 5.19.7 (see C...

CVE-2019-19532

CVE-2019-19532 affects the Linux kernel up to 5.3.8, with multiple out-of-bounds write bugs triggered by a malicious USB device in HID drivers (e.g., HID-AXFF, HID-EMSFF, HID-LOGITECH-HIDPP, HID-MICROSOFT, HID-SONY, HID-TMFF, HID-ZPFF, and others). The root cause is out-of-bounds writes in HID dr...

CVE-2022-1016

The CVE-2022-1016 entry is confirmed to affect the Linux kernel, specifically the nf_tables_core.c component (function nft_do_chain). The flaw is a use-after-free that can lead to a kernel information leak when a local, unprivileged attacker triggers the condition. Connected sources (Astra Linux ...

CVE-2023-3772

CVE-2023-3772 is a Linux kernel vulnerability in the IPsec XFRM subsystem that allows a local attacker with CAP_NET_ADMIN to dereference a NULL pointer in xfrm_update_ae_params(), potentially crashing the kernel and causing a denial of service. Connected documents confirm the root cause as a NULL...

CVE-2023-3776

CVE-2023-3776: A use-after-free in Linux kernel net/sched cls_fw can lead to local privilege escalation if an attacker controls the reference counter in tcf_bind_filter and frees the object by setting the counter to zero. The issue stems from fw_set_parms() returning after reference counter adjus...

CVE-2019-15926

CVE-2019-15926 targets the Linux kernel up to version 5.2.2, with an out-of-bounds access in the Marvell/ ath6kl wireless driver: the functions ath6kl_wmi_pstream_timeout_event_rx and ath6kl_wmi_cac_event_rx in drivers/net/wireless/ath/ath6kl/wmi.c. The connected Nessus entries confirm the flaw e...

CVE-2020-14351

CVE-2020-14351 is a Linux kernel vulnerability in the perf subsystem that enables a local attacker with perf event access to trigger a use-after-free, potentially corrupt memory and escalate privileges. Public sources in connected advisories describe the vulnerability as a local use-after-free af...

CVE-2021-3653

The CVE-2021-3653 issue affects the KVM hypervisor AMD code dealing with SVM nested virtualization. The root cause is improper validation of the int_ctl field in the VMCB provided by an L1 guest, which could allow a malicious L1 to enable AVIC for an L2 guest. Consequences stated across connected...

CVE-2020-29660

This CVE (CVE-2020-29660) affects the Linux kernel tty subsystem, specifically in drivers/tty/tty_io.c and drivers/tty/tty_jobctrl.c, where a locking inconsistency can enable a local attacker to perform a read-after-free against TIOCGSID. Consequences stated in multiple advisories include memory ...

CVE-2020-10690

The CVE-2020-10690 entry affects Linux kernel versions before 5.5. It is caused by a race between the release of ptp_clock and the cdev during resource deallocation, which can free the cdev structure while a high-privileged process holding /dev/ptpX is sleeping. When the underlying device is remo...

CVE-2021-46911

CVE-2021-46911 affects the Linux kernel’s ch_ktls path. The issue was caused by taking the page refcount during skb transmit, which could trigger kernel panics. The documented fix replaces this with taking the tx_ctx lock for the complete skb transmit, preventing page cleanup if an ACK is receive...

CVE-2024-36971

CVE-2024-36971 is a Linux kernel vulnerability where __dst_negative_advice() did not enforce correct RCU rules when sk->dst_cache needed clearing, allowing a possible use-after-free. The issue arises from the wrong clearance order relative to dst_release(old_dst); ip6_negative_advice() has spe...

CVE-2024-56548

CVE-2024-56548 affects the Linux kernel’s hfsplus handling. The root cause is changing device logical block sizes (e.g., via LOOP_SET_BLOCK_SIZE) that can cause a write of out-of-bounds data when hfsplus_read_wrapper calls hfsplus_submit_bio. The fix introduces a new min_io_size, set to the max o...

CVE-2023-52451

CVE-2023-52451 affects the Linux kernel on POWER architectures, where a bounds check oversight in pseries hot-add/hot-remove memory logic allowed potential out-of-bounds access in the drmem lmb array when a DRC index lookup failed. The issue manifested as a dereference of a cursor pointing past t...

CVE-2019-15292

CVE-2019-15292 is a vulnerability in the Linux kernel before 5.0.9 involving a use-after-free in the Appletalk subsystem (atalk_proc_exit), related to the files net/appletalk/atalk_proc.c, net/appletalk/ddp.c, and net/appletalk/sysctl_net_atalk.c. The issue is documented in multiple connected Nes...

CVE-2020-25641

CVE-2020-25641 affects the Linux kernel biovecs implementation in the block layer. A zero-length biovec request can cause the kernel to enter an infinite loop, leading to a local denial of service and availability impact. The vulnerability is exploitable by a local attacker with basic privileges ...

CVE-2020-29368

Affected software: Linux kernel up to version prior to 5.7.5 (pre-5.7.5). Vulnerability details: In mm/huge_memory.c, __split_huge_pmd, the copy-on-write CoW implementation can grant unintended write access due to a race in the THP mapcount check. This race condition can lead to local write acces...

CVE-2021-23134

CVE-2021-23134 is a Linux kernel NFC LLCP use-after-free in nfc sockets (pre-5.12.4). The issue arises from refcount handling during bind/connect fixes, enabling a local attacker with CAP_NET_RAW to trigger a crash or memory corruption. A related CVE discussion confirms the fix: after nfc_llcp_lo...

CVE-2021-33200

CVE-2021-33200 affects the Linux kernel’s eBPF verifier (kernel/bpf/verifier.c) where incorrect limits for pointer arithmetic operations allow out-of-bounds reads/writes in kernel memory, enabling local privilege escalation to root. The issue exists in kernels up to 5.12.7 (upstream). The root ca...