CVE-2025-38102

The CVE CVE-2025-38102 describes a race in VMCI within the Linux kernel between vmci_host_setup_notify and vmci_ctx_unset_notify. A warning can be triggered in try_grab_folio due to a still-in-progress get_user_pages_fast writing to context->notify_page, which may be observed and mismanaged du...

CVE-2025-38108

CVE-2025-38108 affects the Linux kernel’s network scheduler, specifically the RED qdisc. The issue is a race in __red_change() where the SFQ perturb timer can fire at an inopportune time, allowing an underflow of a parent qlen during a concurrent qdisc_tree_flush/backlog sequence. The race scenar...

CVE-2025-38112

CVE-2025-38112 (Linux kernel) : A TOCTOU race in sk_is_readable() can occur when a socket resides in a sockmap. If sk->sk_prot is reloaded after the initial check, sk->sk_prot->sock_is_readable may have become NULL, causing a potential null pointer dereference. The issue stems from the f...

CVE-2025-38123

CVE-2025-38123 concerns the Linux kernel in Azure Linux 3.0. The vulnerability arises in the wwan/t7xx driver during napi rx polling, where a netdev may be released by dellink logic on disconnect, yet skb processing uses an invalid netdev, causing a NULL pointer dereference (kernel panic). The is...

CVE-2025-38185

CVE-2025-38185 (Linux kernel) : The vulnerability in the ATM subsystem (atm/atmtcp.c) arises from freeing an skb with an invalid length in atmtcp_c_send(). The code checks skb->len == 0 but does not fully guard against using skb->data as an atmtcp_hdr when len is non-zero, and when len == 0...

CVE-2025-38189

Technical details about CVE-2025-38189 are not publicly available in the provided Connected documents. The available Initial description contains some information, but no specific affected product/version or impact is confirmed here. Monitor for updated disclosures.

CVE-2025-38249

The CVE CVE-2025-38249 affects the Linux kernel ALSA USB-audio path (snd_usb_get_audioformat_uac3). The root cause is that the length returned by snd_usb_ctl_msg() is used directly to allocate memory and then access the buffer as a uac3_cluster_header_descriptor without verifying the buffer size....

CVE-2025-38260

CVE-2025-38260 concerns a Linux kernel bug in Btrfs where a corrupted csum (checksum) tree root could lead to a crash when mounting with rescue=ibadroots. The provided description details that normally this option should set BTRFS_FS_STATE_NO_DATA_CSUMS to skip csum searches for future data reads...

CVE-2025-38293

The CVE-2025-38293 entry documents a Linux kernel vulnerability in ath11k: arvifs handling. Root cause: during WLAN halt, ath11k_core_halt() reinitializes only the arvifs list head, leaving the subsequent node in arvifs invalid; this makes list_del() detect an invalid node during vif removal if a...

CVE-2025-38297

CVE-2025-38297: In the Linux kernel, a division-by-zero could occur in em_compute_costs() for non-CPU devices due to uninitialized table[i].performance. The fix adds a _is_cpu_device(dev) check to em_init_performance() paths to prevent the division. Public advisories (e.g., openSUSE SUSE-SU-2026:...

CVE-2025-38420

CVE-2025-38420 ffecting the Linux kernel’s wifi Carl9170 driver. The issue occurs when the device that failed firmware loading is pinged; since ieee80211_register_hw() fails, the internal workqueue created by ieee80211_queue_work() is not yet present, causing a null pointer dereference if a queue...

CVE-2025-38456

CVE-2025-38456 concerns Linux kernel ipmi:msghandler memory corruption in ipmi_create_user(). The bug is triggered when the ipmi interface iterator (intf) pointer is invalid (correct intf_num not found); calling atomic_dec on this invalid pointer can corrupt memory. A fix updates the intf path (i...

CVE-2025-38483

CVE-2025-38483 concerns the Linux kernel’s comedi das16m1 IRQ validation. The test for valid IRQs uses a bitmask check on (1 <options[1]), but it->options[i] is an unchecked int from userspace, allowing the shift amount to be negative or out of bounds. The fix adds a bounds check on it->...

CVE-2025-38497

CVE-2025-38497 (Linux kernel) affects usb gadget configfs: writing an empty string to the qw_sign or landingPage sysfs attributes can dereference page[l-1] before length validation, causing an OOB read. The fix adds an early length check in os_desc_qw_sign_store() and webusb_landingPage_store() t...

CVE-2026-45988

The CVE-2026-45988 issue affects the Linux kernel rxrpc subsystem: a RESPONSE packet that experiences a temporary failure could end up partially decrypted and be retried, risking communication disruption or resource exhaustion. The published fix discards the problematic packet and triggers a new ...

CVE-1999-0138

CVE-1999-0138 affects the suidperl and sperl programs, which do not relinquish root privileges when reverting UIDs to the original user. This can grant root access with impact on confidentiality, integrity, and availability as described (local, low complexity, no auth required). The vulnerability...

CVE-2003-0961

CVE-2003-0961: An integer overflow in the Linux kernel do_brk function (brk syscall) affects Linux kernels 2.4.22 and earlier, enabling local users to gain root privileges. The description notes local privilege escalation but the supplied documents do not publish a specific fixed version patch or...

CVE-2004-0497

CVE-2004-0497 describes a local privilege escalation in the Linux kernel 2.x family (notably 2.4/2.6-rc3) due to missing DAC controls in sys_chown, enabling a local user to modify the group ownership of files (including NFS-exported files) they do not own. The underlying issue allows changing fil...

CVE-2004-1070

Technical details (affected kernel versions, vulnerable component, impact, or remediation) are not publicly available in the provided documents. Monitor for updates.

CVE-2007-3731

CVE-2007-3731 affects the Linux kernel 2.6.20/2.6.21. The vulnerability arises from handling an invalid LDT segment selector in %cs during ptrace single-step operations, enabling a local user to trigger a NULL pointer dereference and an OOPS, via PTRACE_SETREGS and PTRACE_SINGLESTEP (TRACE_IRQS_O...

CVE-2007-6151

CVE-2007-6151 affects the Linux kernel ISDN subsystem (ISDN ioctl path). The description in the Initial document states a local user can trigger a denial-of-service via a crafted ioctl struct where iocts is not null-terminated, causing a buffer overflow in isdn_common.c. Connected documents (RHSA...

CVE-2008-1514

CVE-2008-1514 affects the Linux kernel on IBM System z (s390) where a local user can cause a kernel panic via the 31‑bit ptrace padding test. The issue is in arch/s390/kernel/ptrace.c and occurs in kernels from 2.6.9 and in versions older than 2.6.27-rc6. The vulnerability arises from an invalid ...

CVE-2008-4445

CVE-2008-4445 affects the Linux kernel SCTP implementation prior to 2.6.26.4. The vulnerability resides in sctp_auth_ep_set_hmacs (net/sctp/auth.c) where the identifier index is not validated against SCTP_AUTH_HMAC_ID_MAX when SCTP-AUTH is enabled. This can allow local users to obtain sensitive i...

CVE-2009-1883

CVE-2009-1883 affects the Linux kernel z90crypt driver, where a missing capability check in the z90crypt_unlocked_ioctl for the Z90QUIESCE operation can let a local user with an effective UID of 0 bypass restrictions, potentially forcing a driver outage and enabling privilege escalation. The issu...

CVE-2009-4141

CVE-2009-4141 is a local-privilege escalation in the Linux kernel (fs/fcntl.c: fasync_helper) where enabling O_ASYNC on a locked file and closing it can grant privileges. Affected: Linux kernel before 2.6.33-rc4-git1. Root cause: use-after-free in fasync_helper. Mitigation: apply the upstream pat...

CVE-2010-1087

CVE-2010-1087 affects the Linux kernel family 2.6.x up to 2.6.33-rc5. The vulnerability is in nfs_wait_on_request (fs/nfs/pagelist.c) and can cause a denial of service (kernel OOPS) via unknown vectors related to truncating a file and an operation that is not interruptible. The impact is a DoS on...

CVE-2011-4347

CVE-2011-4347 affects the Linux kernel KVM: kvm_vm_ioctl_assign_device in virt/kvm/assigned-dev.c fails to verify permissions for PCI config space and BAR resources, enabling a local attacker (host OS user) to assign PCI devices via KVM_ASSIGN_PCI_DEVICE and cause a host crash; fixed in Linux ker...

CVE-2011-4914

The CVE-2011-4914 issue affects the Linux kernel ROSE protocol implementation prior to 2.6.39. It arises because data-length values are not verified against the actual data sent, enabling remote attackers to read kernel memory (out-of-bounds read) or cause a denial of service via crafted data to ...

CVE-2013-0216

CVE-2013-0216 refers to the Xen netback vulnerability in the Linux kernel prior to 3.7.8. Guest OS users could trigger ring-pointer corruption to cause a denial of service (loop). The linked connected documents ( MiracleLinux AXSA-2013-452:04 and Unity Linux advisories) explicitly list CVE-2013-0...

CVE-2014-2039

CVE-2014-2039 affects the Linux kernel on s390 where arch/s390/kernel/head64.S mishandles attempts to use the linkage stack, enabling local users to crash the system (denial of service) by executing a crafted instruction. The linked Nessus/MiracleUnity/EulerOS advisories confirm the issue exists ...

CVE-2014-3186

CVE-2014-3186 : A buffer overflow in the PicoLCD HID device driver’s picoLCD_raw_event (Linux kernel driver, hid-picolcd_core.c) up to kernel 3.16.3 allows physically proximate attackers to crash the system or potentially execute arbitrary code by sending a crafted large HID report, as used in An...

CVE-2014-3535

CVE-2014-3535 affects the Linux kernel prior to 2.6.36, specifically the include/linux/netdevice.h logging macros. The root cause is incorrect use of macros for netdev_printk, enabling a remote attacker to trigger a NULL pointer dereference and system crash by sending invalid packets to a VxLAN i...

CVE-2015-5706

CVE-2015-5706 is a local-use-after-free vulnerability in the Linux kernel (path_openat in fs/namei.c) affecting 3.x and 4.x before 4.0.4. An attacker can trigger a denial of service (and possibly other impact) via O_TMPFILE filesystem operations that leverage a duplicate cleanup operation. Remedi...

CVE-2016-2070

CVE-2016-2070 affects Linux kernels prior to 4.3.5. The tcp_cwnd_reduction function in net/ipv4/tcp_input.c can be triggered by crafted TCP traffic to cause a divide-by-zero DoS and system crash. According to connected advisories, upgrading to kernel 4.3.5 (as cited in ChangeLog-4.3.5) is the rem...

CVE-2017-6874

The CVE-2017-6874 entry corresponds to a Linux kernel race condition in kernel/ucount.c (through 4.10.2). The vulnerability allows local users to trigger a denial of service (use-after-free and system crash) via crafted system calls that affect the interaction between put_ucounts and get_ucounts....

CVE-2018-7754

CVE-2018-7754 affects the Linux kernel via aoedisk_debugfs_show in drivers/block/aoe/aoeblk.c. The function can be triggered by reading a debugfs file, allowing local users to obtain sensitive address information (ffree: lines). The issue is described as exploitable locally with kernel up to 4.16...

CVE-2021-4440

CVE-2021-4440 (Linux kernel) fixed by commit afd30525a659ac0ae0904f0cb4a2ca75522c3123 upstream: in x86/xen, the paravirt USERGS_SYSRET64 path was dropped and the exit from user space now uses the iret exit from the start instead of sysret, avoiding stack-mangling prerequisites in Xen PV guests. T...

CVE-2021-47100

CVE-2021-47100 is a Linux kernel vulnerability that causes a use-after-free (UAF) during uninstall of ipmi_si and ipmi_msghandler modules, leading to kernel oops/panic. The issue occurs when rmmod ipmi_si is followed by ipmi_msghandler removal, triggering kref_put cleanup that schedules a work it...

CVE-2021-47137

CVE-2021-47137 affects the Linux kernel, specifically the net/lantiq RX ring. When memory allocation or DMA mapping fails, an invalid address may be programmed into the descriptor, causing memory corruption. The patch fixes this by ensuring that, on allocation failure, DMA reuses the previous skb...

CVE-2021-47192

CVE-2021-47192 is a Linux kernel vulnerability in the scsi/core sysfs path that caused a hang/deadlock when a device state is changed via sysfs after iSCSI recovery. The root cause described in connected advisories is that rescan was invoked with state_mutex still held, leading to scsi_host_in_re...

CVE-2021-47205

CVE-2021-47205 affects the Linux kernel clk: sunxi-ng component (CCU clocks/resets). The root cause is that during unbinding of a CCU driver, the device MMIO region is unmapped while clocks/resets and their providers remain registered, which can lead to page faults when clock operations access MM...

CVE-2021-47261

CVE-2021-47261 affects the Linux kernel mlx5 IB driver. The CQ fragment initialization could read from the wrong buffer due to using get_cqe(), risking kernel panic when CQ size grows. The fix uses mlx5_frag_buf_get_wqe() to obtain CQEs from the correct source buffer, mitigating the issue. The li...

CVE-2021-47276

The CVE-2021-47276 issue affects the Linux kernel’s ftrace on arm64, where -EINVAL could trigger ftrace_bug() to read the instruction pointer value from an invalid address, causing a kernel panic. The root cause was reading the ip address directly from memory when reporting the error. The remedy ...

CVE-2021-47277

CVE-2021-47277 affects the Linux kernel KVM path for guest memory translation. The issue arises when speculative execution may use an invalid guest frame number (gfn) to compute an out-of-bounds host virtual address (hva) in __gfn_to_hva_memslot, enabling a potential two-read Spectre gadget where...

CVE-2021-47331

The CVE-2021-47331 issue affects the Linux kernel usb-conn-gpio path. Root cause: an IDDIG interrupt can occur before charger registration, causing a NULL pointer dereference. Fix: register the power supply before requesting IDDIG/VBUS IRQ to prevent the dereference. Affected scope and exact reme...

CVE-2021-47426

CVE-2021-47426 affects the Linux kernel (bpf, s390) with a memory leak in jit_data. The issue occurs in the error path and is resolved by freeing jit_data with kfree() to prevent leaks. The provided metrics indicate local access, low attack complexity, and low privileges needed, with no confident...

CVE-2021-47462

CVE-2021-47462 affects the Linux kernel mempolicy/memory policy handling. The root cause was an invalid combination check for MPOL_MODE_FLAGS: MPOL_F_NUMA_BALANCING may only pair with MPOL_BIND, but the check existed only in do_set_mempolicy(). The patch moves this validation into sanitize_mpol_f...

CVE-2021-47525

CVE-2021-47525 affects the Linux kernel, specifically the serial liteuart driver. The issue is a use-after-free and memory leak that occurs on unbind, where the port may remain registered after driver data is released, leading to potential use after free and serial-core memory leaks. The publishe...

CVE-2021-47643

CVE-2021-47643 is a Linux kernel issue in the media/ ir_toy area; it fixes a leak in the error path by freeing a resource before exiting on error. Affected component is the kernel’s ir_toy driver code, where an error exit path could leak memory. The vulnerability is local in scope with a CVSS v3....

CVE-2021-47647

CVE-2021-47647 relates to the Linux kernel on Qualcomm IPQ8074 PCIe clock driver. The root cause is a missing clock parent setup in pcie0_rchng_clk_src: there were two declared parents but only one was actually provided via parent_hws, and the fix introduces the use of clk_parent_data to supply t...