CVE-2020-36322

The CVE-2020-36322 issue affects the Linux kernel FUSE filesystem implementation, where fuse_do_getattr() could call make_bad_inode() in inappropriate situations, potentially causing a system crash. The vulnerability is tied to the FUSE path and was partially addressed by a fix, with the incomple...

CVE-2019-19068

CVE-2019-19068 affects the Linux kernel Realtek RTL8xxxU USB Wi‑Fi driver (rtl8xxxu_submit_int_urb in rtl8xxxu_core.c, up to 5.3.11). The root cause is a memory leak when usb_submit_urb() fails during interrupt-URB submission, which can lead to DoS via memory consumption. Connected document F5 ad...

CVE-2024-53150

The CVE-2024-53150 issue affects the Linux kernel USB-audio (ALSA: usb-audio). The root cause is that the driver does not validate the bLength field of descriptors while traversing clock-related descriptors, allowing a bogus shorter descriptor to cause out-of-bounds reads. The public patch adds s...

CVE-2020-29368

Affected software: Linux kernel up to version prior to 5.7.5 (pre-5.7.5). Vulnerability details: In mm/huge_memory.c, __split_huge_pmd, the copy-on-write CoW implementation can grant unintended write access due to a race in the THP mapcount check. This race condition can lead to local write acces...

CVE-2020-29661

The entry CVE-2020-29661 describes a local, kernel-space vulnerability in the Linux tty subsystem (drivers/tty/tty_jobctrl.c) that can enable a use-after-free through TIOCSPGRP. A locking issue in this path allows memory corruption and potential privilege escalation or system impact when an attac...

CVE-2023-34319

CVE-2023-34319 is a Linux kernel netback driver buffer overrun caused by an edge case where an entire packet is fragmented into the maximum pieces yet remains smaller than the area that preserves all headers together, after the XSA-423 fix. Exploitation could enable local denial-of-service or ins...

CVE-2021-46943

CVE-2021-46943 : Linux kernel vulnerability in media: staging/intel-ipu3 where a faulty set_fmt error handling could cause mis-updated sizes, enabling a local exploit path that, without the fix, could trigger excessive RAM use (up to 4 GiB) and an OOPS. The issue stems from overwriting previous v...

CVE-2022-27666

CVE-2022-27666 describes a heap buffer overflow in IPsec ESP transformation code (net/ipv4/esp4.c and net/ipv6/esp6.c) that can allow a local user to overwrite kernel heap objects and may lead to local privilege escalation. Connected advisories confirm kernel patches are available (e.g., AlmaLinu...

CVE-2019-19447

CVE-2019-19447 is a Linux kernel 5.0.21 flaw where mounting a crafted ext4 filesystem image can trigger a use-after-free in ext4_put_super (fs/ext4/super.c, related to dump_orphan_list). Reports in multiple connected sources corroborate a local, post-authentication impact with potential arbitrary...

CVE-2019-3900

CVE-2019-3900 is an upstream Linux kernel vulnerability in the vhost_net module causing an infinite loop while handling incoming packets in handle_rx(), which can allow a guest user to stall the vhost_net kernel thread and trigger a DoS. The issue is present in Linux kernel releases up to and inc...

CVE-2021-43056

CVE-2021-43056 affects the Linux kernel for POWERPC (Power8) prior to 5.14.15. The root cause is a bug in arch/powerpc/kvm/book3s_hv_rmhandlers.S handling of SRR1 values, which can allow a malicious KVM guest to crash the host (availability impact). The issue is documented across multiple sources...

CVE-2021-46922

CVE-2021-46922 concerns the Linux kernel KEYS: trusted TPM reservation for seal/unseal. The patch 8c657a0590de dropped tpm_try_get_ops() in tpm2_seal_trusted() during a rebase, causing imbalanced TPM ops and oopses on TIS hardware. The fix reinstates the lost tpm_try_get_ops().

CVE-2018-20855

CVE-2018-20855 affects Linux kernel before 4.18.7. In mlx5InfiniBand, create_qp_common (mlx5_ib_create_qp_resp) was never initialized, leaking stack memory to userspace. Upstream fix shipped with kernel 4.18.7 (commit 0625b4ba1a5d4703c7fb01c497bd6c156908af00). Mitigation: upgrade to 4.18.7+ or ap...

CVE-2019-20054

CVE-2019-20054 affects the Linux kernel prior to 5.0.6, with a NULL pointer dereference in drop_sysctl_table() in fs/proc/proc_sysctl.c (related to put_links, CID-23da9588037e). The fix is included in kernel 5.0.6 (and later). Public exploit details are not provided in the supplied documents. Rec...

CVE-2020-14351

CVE-2020-14351 is a Linux kernel vulnerability in the perf subsystem that enables a local attacker with perf event access to trigger a use-after-free, potentially corrupt memory and escalate privileges. Public sources in connected advisories describe the vulnerability as a local use-after-free af...

CVE-2022-1462

CVE-2022-1462 is an out-of-bounds read in the Linux kernel TeleTYpe subsystem triggered by a race using ioctls (TIOCSPTLCK, TIOCGPTPEER, TIOCSTI, TCXONC). Local users can crash the system or read unauthorized memory. Public advisories link this CVE to Linux kernel versions across multiple distrib...

CVE-2023-3776

CVE-2023-3776: A use-after-free in Linux kernel net/sched cls_fw can lead to local privilege escalation if an attacker controls the reference counter in tcf_bind_filter and frees the object by setting the counter to zero. The issue stems from fw_set_parms() returning after reference counter adjus...

CVE-2020-14331

CVE-2020-14331 is a Linux kernel vulnerability in the VGA console driver’s soft-scrollback path. A local user with access to a VGA console can trigger an out-of-bounds write when resizing the console via VT_RESIZE, potentially crashing the system and possibly escalating privileges. Publicly docum...

CVE-2021-44733

CVE-2021-44733 is a use-after-free in the Linux kernel TEE subsystem (drivers/tee/tee_shm.c) that can occur during freeing of a shared memory object due to a race in tee_shm_get_from_id. Affects Linux kernels up to 5.15.11; exploitation could lead to denial of service and, in some configurations,...

CVE-2020-10942

CVE-2020-10942 affects Linux kernel pre-5.5.8: vhost-net get_raw_socket fails to validate sk_family in drivers/vhost/net.c, enabling local attackers to induce kernel stack corruption via crafted syscalls, with potential DoS or privilege escalation. The connected doc from ALAS2LIVEPATCH-2020-015 n...

CVE-2021-3612

CVE-2021-3612 is an out-of-bounds memory write flaw in the Linux kernel joystick subsystem exploitable by a local user via the JSIOCSBTNMAP ioctl. The advisory notes potential system crash and possible privilege escalation. Affected disclosures reference pre-5.13.2 revisions (e.g., fixes upstream...

CVE-2021-3679

CVE-2021-3679 affects the Linux kernel tracing subsystem (trace ring buffer) prior to 5.14-rc3. The flaw arises in how a user uses the trace ring buffer, enabling a privileged local attacker (CAP_SYS_ADMIN) to starve CPU resources and cause denial of service. The connected documents consistently ...

CVE-2019-19532

CVE-2019-19532 affects the Linux kernel up to 5.3.8, with multiple out-of-bounds write bugs triggered by a malicious USB device in HID drivers (e.g., HID-AXFF, HID-EMSFF, HID-LOGITECH-HIDPP, HID-MICROSOFT, HID-SONY, HID-TMFF, HID-ZPFF, and others). The root cause is out-of-bounds writes in HID dr...

CVE-2020-29660

This CVE (CVE-2020-29660) affects the Linux kernel tty subsystem, specifically in drivers/tty/tty_io.c and drivers/tty/tty_jobctrl.c, where a locking inconsistency can enable a local attacker to perform a read-after-free against TIOCGSID. Consequences stated in multiple advisories include memory ...

CVE-2022-42703

CVE-2022-42703 affects the Linux kernel prior to 5.19.7 via a use-after-free in leaf anon_vma double reuse in mm/rmap.c. This enables local escalation of privilege (per CVSS: LOCAL, HIGH availability impact, LOW complexity, no user interaction). Upstream fixes were applied in kernel 5.19.7 (see C...

CVE-2020-10766

CVE-2020-10766 is a Linux kernel vulnerability tied to the SSBD mitigation logic, enabling a local attacker to temporarily disable SSBD during a context switch due to per-task STIPB switching. Connected advisories confirm affected kernels (e.g., Linux 5.4.x/5.8 era) and provide patch info: Debian...

CVE-2018-17972

The CVE-2018-17972 issue affects the Linux kernel (proc_pid_stack in fs/proc/base.c) up to 4.18.11, where an attacker with local access could exploit race in stack unwinding to leak kernel task stack contents. The root cause is insufficient restriction on inspecting kernel stacks, enabling local ...

CVE-2019-19523

CVE-2019-19523 affects the Linux kernel prior to 5.3.7, where a use-after-free can be caused by a malicious USB device via the drivers/usb/misc/adutux.c driver (CID-44efc269db79). Affected systems include distributions referenced in accompanying advisories (e.g., MiracleLinux 8, Unity Linux 20.x)...

CVE-2020-12654

CVE-2020-12654 affects the Linux kernel prior to 5.5.4. The vulnerability is a heap-based buffer overflow in mwifiex_ret_wmm_get_status() (drivers/net/wireless/marvell/mwifiex/wmm.c) caused by an incorrect memcpy when processing WMM parameters from a remote AP. A crafted AP can trigger overflow a...

CVE-2020-24586

CVE-2020-24586 describes a fragmentation cache issue in the Linux kernel Wi‑Fi stack: received fragments are not cleared from memory on reconnect, enabling an attacker within Wi‑Fi range to inject arbitrary packets or exfiltrate data when fragments encrypted with WEP/CCMP/GCMP are involved. Conne...

CVE-2017-7308

CVE-2017-7308 applies to the Linux kernel AF_PACKET packet_set_ring implementation. The issue arises from insufficient validation of certain block-size data in net/packet/af_packet.c, enabling a local user with CAP_NET_RAW to trigger a denial of service (integer signedness error and out-of-bounds...

CVE-2020-24394

CVE-2020-24394 affects the Linux kernel before 5.7.8 in the NFS server (fs/nfsd/vfs.c). The root cause is that ACL-less filesystems do not apply the current umask when creating new objects, allowing an attacker with local access to set incorrect permissions. Public details in connected advisories...

CVE-2020-12826

CVE-2020-12826 affects the Linux kernel before 5.6.5. The root cause is an integer overflow in exec_id (include/linux/sched.h) due to 32-bit sizing, which can allow a child process to send an arbitrary signal to a parent process in a different security domain, bypassing protection. A patched vers...

CVE-2021-46920

CVE-2021-46920 concerns the Linux kernel DMAengine idxd; the bug is a clobber of the SWERR overflow bit during writeback where the code overwrites SWERR/OVERFLOW instead of restoring the bits read. Affected: Linux kernel with idxd component; root cause: writeback path writes read values back, pre...

CVE-2023-2163

Summary of CVE-2023-2163 : The issue is an incorrect verifier pruning in the kernel’s BPF verifier for Linux kernel versions >= 5.4, where unsafe code paths can be marked safe, enabling arbitrary reads/writes in kernel memory, lateral privilege escalation, and container escapes. Connected advi...

CVE-2019-15221

CVE-2019-15221 affects the Linux kernel up to version 5.1.17. A NULL pointer dereference can be triggered by a malicious USB device via the sound/usb/line6/pcm.c driver, leading to denial of service or system instability. Affected component is the kernel sound USB Line6 PCM driver; root cause is ...

CVE-2021-4037

Summary: CVE-2021-4037 affects the Linux kernel’s inode_init_owner() logic for XFS SGID directories, enabling local users to create files with unintended group ownership and SGID/group-exec bits when the directory is SGID and writable to non-group members. The issue is linked to a missed fix rela...

CVE-2021-45485

CVE-2021-45485 affects the Linux kernel IPv6 path: net/ipv6/output_core.c exposes an information leak due to how a hash table is used, enabling IPv6 source address-based observation. Impact is partial confidentiality exposure; no integrity/availability impact stated. Affected: Linux kernel prior ...

CVE-2023-6546

CVE-2023-6546 describes a race condition in the Linux kernel’s GSM 0710 tty multiplexor. Two threads can race on GSMIOC_SETCONF on the same tty when gsm line discipline is enabled, triggering a use-after-free of the gsm_dlci during GSM mux restart and potentially enabling local privilege escalati...

CVE-2019-19770

CVE-2019-19770 affects the Linux kernel 4.19.83 and is described as a use-after-free (read) in the debugfs_remove function (fs/debugfs/inode.c), which handles removal of files/dirs created via debugfs. Note: kernel developers dispute this as a debugfs issue, characterizing it as misuse of debugfs...

CVE-2019-13631

The CVE-2019-13631 entry describes a vulnerability in the Linux kernel (parse_hid_report_descriptor in drivers/input/tablet/gtco.c) where a malicious USB HID device can cause an out-of-bounds write during debugging message generation. This affects kernels up to version 5.2.1. The document does no...

CVE-2023-1859

CVE-2023-1859 is a use-after-free in Xen transport 9pfs (xen_9pfs_front_removet in net/9p/trans_xen.c) of the Linux kernel. Connected security bulletins confirm a race condition that could allow a local attacker to crash the system and potentially leak kernel information. Affected is the Xen 9pfs...

CVE-2020-36311

CVE-2020-36311 affects the Linux kernel prior to 5.9. In arch/x86/kvm/svm/sev.c, destroying a large SEV VM (unregistering many encrypted regions) can trigger a denial of service (soft lockup). The connected advisories confirm the issue and point to a fix in kernel 5.9 (and changelog indicating th...

CVE-2021-46916

CVE-2021-46916 affects the ixgbe driver in the Linux kernel, where a NULL pointer dereference can occur during the ethtool loopback test due to a missing q_vector for the test ring. The fix adds a check for a q_vector and, if absent, returns a napi_id value of 0. This resolves a potential crash/D...

CVE-2023-6176

The connected documents confirm CVE-2023-6176 is a Linux kernel issue in the cryptographic algorithm scatterwalk API. A null pointer dereference can be triggered when a local user constructs a malicious packet with specific socket configuration, potentially crashing the system or enabling privile...

CVE-2021-20322

CVE-2021-20322 relates to a Linux kernel ICMP handling flaw (ICMP fragment needed/redirect) that lets an off-path attacker quickly discover UDP port usage, bypassing UDP source port randomization. The connected advisories confirm this affects the Linux kernel and multiple distributions and mentio...

CVE-2021-46914

CVE-2021-46914 concerns the Linux kernel ixgbe driver, where suspend/resume code caused an unbalanced device enable/disable sequence. The root cause was a removal of pci_enable_device_mem() from ixgbe_resume(), which in combination with pci_disable_device() in __ixgbe_shutdown() could over- or un...

CVE-2023-3772

CVE-2023-3772 is a Linux kernel vulnerability in the IPsec XFRM subsystem that allows a local attacker with CAP_NET_ADMIN to dereference a NULL pointer in xfrm_update_ae_params(), potentially crashing the kernel and causing a denial of service. Connected documents confirm the root cause as a NULL...

CVE-2020-13143

CVE-2020-13143 affects the Linux kernel USB gadget/configfs (drivers/usb/gadget/configfs.c) from 3.16 to 5.6.13. The flaw arises when gadget_dev_desc_UDC_store uses kstrdup and may encounter an internal NUL value, leading to potential out-of-bounds memory access (reported as heap out-of-bounds wr...

CVE-2021-33200

CVE-2021-33200 affects the Linux kernel’s eBPF verifier (kernel/bpf/verifier.c) where incorrect limits for pointer arithmetic operations allow out-of-bounds reads/writes in kernel memory, enabling local privilege escalation to root. The issue exists in kernels up to 5.12.7 (upstream). The root ca...