CVE-2024-43881

CVE-2024-43881 : In the Linux kernel, the ath12k driver used by wifi in fragmented packets reinjects fragments as normal packets. The DMA direction must be DMA_TO_DEVICE when reinjecting fragments; using DMA_FROM_DEVICE can cause an invalid payload to be reinjected and delivered to the host, enab...

CVE-2024-44979

CVE-2024-44979 affects the Linux kernel: drm/xe component (xe_gt_pagefault) mishandled workqueue destruction, leading to potential memory retention on driver reload. A fix was applied to destroy the pagefault and access-counter workqueues, cherry-picked from commit 7586fc52b14e0b8edd0d1f8a434e0de...

CVE-2024-46748

The CVE-2024-46748 entry concerns the Linux kernel cachefiles subsystem. It fixes a write-size issue by setting the maximum subrequest size for cache writes to MAX_RW_COUNT, preventing overruns on backing filesystems. Connected docs confirm the fix applies to Linux kernel versions using this code...

CVE-2024-46776

The CVE-2024-46776 entry corresponds to a Linux kernel flaw in the DRM/AMD display pipeline. The issue arises when the DC_LOG_DC is executed before verifying link_enc, allowing an invalid state that prompted a reported reverse_inull defect; the fix corrects the sequence by running DC_LOG_DC only ...

CVE-2024-46792

CVE-2024-46792: In the Linux kernel, RISCV misaligned handling in raw_copy_to_user()/raw_copy_from_user() did not call access_ok(), potentially allowing a local user to access arbitrary kernel memory addresses. The vulnerability is tied to how user space memory is accessed and has been fixed in t...

CVE-2024-46838

CVE-2024-46838 affects the Linux kernel. The issue arises in userfaultfd when khugepaged yanks a page table, where previous BUG_ON() checks were incorrect after allowing retracting page tables in file mappings without the mmap lock. The fix removes these BUG_ON()s (and associated early block) to ...

CVE-2024-56673

Technical details about CVE-2024-56673 are not provided in the supplied documents. Monitor for updates from the vendors/security advisories for affected products, fixes, and mitigations.

CVE-2024-57928

CVE-2024-57928 (Linux kernel) : The vulnerability is in netfs buffered reads. When netfs_read_to_pagecache() encounters an error from either ->prepare_read() or netfs_prepare_read_iterator(), it must decrement ->nr_outstanding, cancel the subrequest, and break the issuing loop. The patch fi...

CVE-2025-21641

CVE-2025-21641 concerns the Linux kernel, where the mptcp: sysctl: blackhole timeout vulnerability could occur from using current->nsproxy. The issue arises from reading net namespace data via the current task, which could be NULL for certain states (e.g., task exiting), risking a null pointer...

CVE-2025-21849

CVE-2025-21849: Linux kernel drm/i915/gt had potential deadlocks due to spin_lock/unlock() used in interrupt contexts. The fix saves irq state before acquiring locks. Version history shows v2 adds irq state save/restore around signal_irq_work locks; v3 uses spin_lock_irqsave() in guc_lrc_desc_unp...

CVE-2025-21902

CVE-2025-21902 affects the Linux kernel (ACPI backends for UCSI). The vulnerability arises from the ucsi core handling of CCI polling and ACPI-opregion synchronization: backends may rely on an unnecessary/unsafe sync, which can be triggered while notifications are disabled and lead to a spurious ...

CVE-2025-22048

The CVE-2025-22048 entry concerns LoongArch support in the Linux kernel where BPF return-value handling was fixed. The root cause was that after a commit that sign-extended the a5 return register to a0, the subsequent propagation from a0 back to a5 occurred for all function calls, which was incor...

CVE-2025-22114

CVE-2025-22114 (Linux kernel, btrfs) is fixed: the patch prevents clobbering the previously set return value in btrfs_validate_super() by ensuring validate_sys_chunk_array() does not wipe the early validity checks. The root cause is that the call to validate_sys_chunk_array() could overwrite ret,...

CVE-2025-37783

CVE-2025-37783 — Linux kernel (drm/msm/dpu) The issue occurs where dpu_plane_virtual_atomic_check could dereference pointers returned by drm_atomic_get_plane_state without verifying for errors, leading to undefined behavior. The fix adds IS_ERR checks to ensure plane_state is valid before derefer...

CVE-2025-37837

CVE-2025-37837 addresses warnings in the Linux kernel: iommu/tegra241-cmdqv dmam_free_coherent() warnings during SMMU rollback and a memory-usage warning (128 pages) from free_contig_range, traced to devres-managed LVCMDQ resources freed by devm_action_release. The fix removes the unwind path in ...

CVE-2025-37843

CVE-2025-37843 : In the Linux kernel, a race between parent and child PCI hotplug ports can deadlock during nested PCI hotplug removal. A fix was implemented to avoid extra checks when the hotplug port itself was hot-removed, preventing the deadlock (particularly when removing multiple Thunderbol...

CVE-2025-37888

Technical details for CVE-2025-37888 are not provided in the supplied documents; only a high-level description of the Linux kernel fix is shown. Please monitor for vendor advisories for affected products and remediation.

CVE-2025-38024

CVE-2025-38024 pertains to the Linux kernel RDMA/rxe path. The issue is a slab-use-after-free Read in rxe_queue_cleanup, triggered when rxe_cq_from_init fails during CQ creation and the subsequent rxe_cleanup is responsible for freeing resources. Some memory has already been freed in rxe_cq_from_...

CVE-2025-38040

CVE-2025-38040 affects the Linux kernel’s serial/mctrl_gpio path. The advisory reports a fix for a denial of service/privilege implications by splitting the disabling of modem lines (disable_ms) into two APIs: sync and no_sync, addressing a sleeping function being called from an atomic context (d...

CVE-2025-38065

CVE-2025-38065: In the Linux kernel’s OrangeFS inode handling, the len variable used to store the result of i_size_read() becomes a size_t, causing truncation to 4 GiB on 32-bit systems. This can lead to incorrect file size handling and potential impact on local processes that rely on accurate si...

CVE-2025-38086

CVE-2025-38086 involves a Linux kernel vulnerability in net/ch9200 where mii_nway_restart() can trigger an uninitialised access through ch9200_mdio_read() due to not checking control_read() return value. The bug stems from an uninitialised local buffer (buff) being accessed when control_read() do...

CVE-2025-38292

The CVE-2025-38292 issue affects the Linux kernel’s wifi driver ath12k, where in ath12k_dp_rx_msdu_coalesce() the code may access rxcb->is_continuation after freeing the associated skb, causing a use-after-free. The fix is to locally copy the is_continuation value from rxcb so further referenc...

CVE-2025-38293

The CVE-2025-38293 entry documents a Linux kernel vulnerability in ath11k: arvifs handling. Root cause: during WLAN halt, ath11k_core_halt() reinitializes only the arvifs list head, leaving the subsequent node in arvifs invalid; this makes list_del() detect an invalid node during vif removal if a...

CVE-2025-38304

CVE-2025-38304 : In the Linux kernel, a NULL pointer dereference in Bluetooth eir_get_service_data (len parameter can be NULL) is fixed. The vulnerability affects the Bluetooth EIR handling path and is rated with LOCAL attack vector and HIGH availability impact, implying potential kernel crash or...

CVE-2025-38345

CVE-2025-38345: Linux kernel ACPICA ACPI operand cache leak in dswstate.c fixed by ACPICA patch (commit 987a3b5c...). Root cause: miscalculated stack top in acpi_ds_obj_stack_pop_and_delete() vs acpi_ds_obj_stack_push(), leading to kmem_cache_destroy Acpi-Operand memory leak during early terminat...

CVE-2025-38351

CVE-2025-38351 affects the Linux kernel KVM component (x86) when Hyper-V hypercalls are enabled. The issue arises in PV TLB flush processing where non-canonical GVAs can reach INVVPID/INVLPGA paths, potentially triggering VM-Fail on Intel hardware (AMD may ignore). In practice, this can allow a g...

CVE-2025-38441

CVE-2025-38441 affects the Linux kernel netfilter flowtable nf_flow_pppoe_proto() where the Ethernet header was not accounted for in PPPoE offload logic, leading to potential use of uninitialized data (KMSAN). The vulnerability is locally exploitable; CVSS 3.1/AV:L/AC:L/PR:L/UI:N/S:U/I:N/A:H with...

CVE-2025-38466

CVE-2025-38466 is a Linux kernel security issue where uprobes could be abused due to inability to reliably verify instruction boundaries in the middle of an instruction, and on some architectures (e.g., arm64) when data words are misinterpreted as instructions. The fix reverts to requiring CAP_SY...

CVE-2025-38483

CVE-2025-38483 concerns the Linux kernel’s comedi das16m1 IRQ validation. The test for valid IRQs uses a bitmask check on (1 <options[1]), but it->options[i] is an unchecked int from userspace, allowing the shift amount to be negative or out of bounds. The fix adds a bounds check on it->...

CVE-2025-38497

CVE-2025-38497 (Linux kernel) affects usb gadget configfs: writing an empty string to the qw_sign or landingPage sysfs attributes can dereference page[l-1] before length validation, causing an OOB read. The fix adds an early length check in os_desc_qw_sign_store() and webusb_landingPage_store() t...

CVE-2026-46116

CVE-2026-46116 affects the Linux kernel xfrm subsystem (xfrm_state). The root cause is a local-use-after-free in __xfrm_state_delete due to unsafe deletions from byseq/byspi hash chains. The patch changes deletions to hlist_del_init_rcu and uses hlist_unhashed() checks, preventing writes after LI...

CVE-2004-0814

CVE-2004-0814 describes race conditions in the Linux terminal layer (kernel 2.4.x and 2.6.x prior to 2.6.9). Root causes include a TIOCSETD ioctl race on a terminal interface accessed by multiple threads and a separate race when switching from console to PPP line discipline, which could allow loc...

CVE-2006-4814

CVE-2006-4814 is a mincore-related Linux kernel vulnerability restricted to older kernels (before 2.4.33.6) where access to user space was not properly locked, potentially causing a system hang (deadlock). Public sources in connected advisories confirm this CVE as part of multiple kernel updates,...

CVE-2006-7203

CVE-2006-7203 affects the Linux kernel 2.6.20 and earlier, via compat_sys_mount in fs/compat.c. When mounting a smbfs filesystem in compatibility mode (mount -t smbfs), a local user can trigger a NULL pointer dereference (and oops), leading to denial of service. Publicly documented references (RH...

CVE-2007-4571

CVE-2007-4571 affects the ALSA portion of the Linux kernel before 2.6.22.8. The snd_mem_proc_read function in sound/core/memalloc.c does not return the correct write size, enabling a local user to read kernel memory contents via a small count argument (demonstrated by reading /proc/driver/snd-pag...

CVE-2007-5500

The CVE-2007-5500 issue is described in connected documents as a vulnerability in the Linux kernel (2.6.x) where the wait_task_stopped routine checks a TASK_TRACED bit instead of exit_state. This could allow a local unprivileged user to cause a denial of service (machine crash) via unspecified ve...

CVE-2008-3915

CVE-2008-3915 is a buffer overflow in the Linux kernel’s nfsd when NFSv4 is enabled. The issue can allow remote triggering of a denial of service via crafted NFSv4 ACL decoding; affected are kernels older than 2.6.26.4. The Debian/Ubuntu advisories in the connected set reference this CVE among a ...

CVE-2009-3624

CVE-2009-3624 affects the Linux kernel KEYS subsystem. The get_instantiation_keyring function in security/keys/keyctl.c fails to properly maintain the reference count of a keyring when a keyring is not specified by ID, enabling a local attacker to gain privileges or trigger a denial of service (O...

CVE-2009-4895

CVE-2009-4895 describes a race condition in the Linux kernel's tty_fasync path (drivers/char/tty_io.c) prior to 2.6.32.6, enabling local users to cause a denial of service via a NULL pointer dereference and system crash. The issue is tied to put_tty_queue and __f_setown, with a note that it was a...

CVE-2010-4563

The Connected documents provide concrete detail for CVE-2010-4563: when the Linux kernel handles IPv6, an attacker can probe for sniffing by sending an ICMPv6 Echo Request to a multicast address and observing whether an Echo Reply is returned (as shown by thcping). This affects the Linux kernel’s...

CVE-2010-4650

The CVE-2010-4650 issue affects the Linux kernel’s fuse_do_ioctl in fs/fuse/file.c, where a buffer overflow could be exploited by a CUSE server to achieve local denial of service or potential other impact. Multiple connected sources confirm a fix in kernel 2.6.37 and note that exploitation requir...

CVE-2011-4913

CVE-2011-4913 affects the Linux kernel before 2.6.39. The rose_parse_ccitt function in net/rose/rose_subr.c does not validate FAC_CCITT_DEST_NSAP and FAC_CCITT_SRC_NSAP fields, allowing remote attackers to cause a denial of service (integer underflow, heap memory corruption, panic) with a small l...

CVE-2012-0028

CVE-2012-0028 affects the Linux kernel’s futex implementation prior to version 2.6.28. The root cause is that processes executing an exec can write to memory in a child process due to improper futex handling, potentially allowing local users to cause a denial of service or to gain privileges. The...

CVE-2013-0217

The CVE-2013-0217 entry concerns memory leakage in the Linux kernel Xen netback driver (drivers/net/xen-netback/netback.c). The issue affects the Xen netback functionality in Linux kernel versions prior to 3.7.8, enabling a guest OS user to trigger error conditions that lead to memory exhaustion ...

CVE-2013-0309

CVE-2013-0309 affects arch/x86/include/asm/pgtable.h in the Linux kernel prior to 3.6.2 when Transparent Huge Pages are used. The issue: PROT_NONE memory regions are not properly supported, enabling a local user to trigger a denial of service (system crash). The connected Nessus advisories for Un...

CVE-2013-0310

The issue CVE-2013-0310 affects the Linux kernel, specifically the cipso_v4_validate function in net/ipv4/cipso_ipv4.c. In kernels prior to 3.4.8, local attackers can trigger a NULL pointer dereference and system crash via IPOPT_CIPSO IP_OPTIONS used with setsockopt, enabling potential local deni...

CVE-2013-2128

The CVE-2013-2128 issue affects the Linux kernel’s tcp_read_sock() in net/ipv4/tcp.c where skb consumption is not properly managed. This can allow local attackers to trigger a denial of service (system crash) by issuing a crafted splice() on a TCP socket. Evidence appears across multiple advisori...

CVE-2013-2140

CVE-2013-2140 affects the Linux kernel before 3.10.5, via dispatch_discard_io in Xen blkback (drivers/block/xen-blkback/blkback.c). It enables a guest OS user to trigger a denial of service (data loss) through write operations on read-only disks that support BLKIF_OP_DISCARD/TRIM or SCSI UNMAP. T...

CVE-2013-2146

CVE-2013-2146 affects the Linux kernel (pre-3.8.9) in the x86 Perf Event subsystem. The vulnerable component is arch/x86/kernel/cpu/perf_event_intel.c, which uses an incorrect bitmask when the Performance Events Subsystem is enabled. Under this condition, a local user can trigger a denial of serv...

CVE-2013-7027

The CVE-2013-7027 entry concerns the Linux kernel vulnerability in the ieee80211_radiotap_iterator_init function (net/wireless/radiotap.c) prior to 3.11.7. The issue is that the code does not validate whether a frame contains data outside of the header, which may allow an attacker to trigger a de...