CVE-2025-38149

CVE-2025-38149 — Linux kernel net: phy: clear phydev->devlink when the link is deleted . The issue causes a crash when disabling and re-enabling a network port because phydev->devlink is not cleared after phy_detach() calls device_link_del(), leaving a stale value that is dereferenced on re...

CVE-2025-38206

CVE-2025-38206 concerns the Linux kernel exfat subsystem, where a double free could occur in the delayed_free pathway during exfat_kill_sb() via exfat_free_upcase_table(). The vulnerability arises when freeing vol_utbl twice due to an error return path in exfat_create_upcase_table() leading to a ...

CVE-2025-38304

CVE-2025-38304 : In the Linux kernel, a NULL pointer dereference in Bluetooth eir_get_service_data (len parameter can be NULL) is fixed. The vulnerability affects the Bluetooth EIR handling path and is rated with LOCAL attack vector and HIGH availability impact, implying potential kernel crash or...

CVE-2025-38354

CVE-2025-38354 (Linux kernel, DRM/MSM GPU): A crash can occur when throttling GPU immediately during boot if the GPU is already hot, because of an early call to of_devfreq_cooling_register() that may access GMU registers before initialization. The root cause is that msm_devfreq_init may suspend d...

CVE-2025-38401

The CVE-2025-38401 issue affects the Linux kernel’s mtk-sd driver, where a DMA map failure in msdc_prepare_data() could lead to memory corruption if data DMA is started with stale settings. The vulnerability’s description and related advisories (including Debian LTS DLA entries and Amazon Linux A...

CVE-2025-38449

CVE-2025-38449 affects the Linux kernel DRM/GEM subsystem. The issue arises when a GEM handle is released while the GEM buffer object remains attached to a DRM framebuffer, which can lead to releasing the dma-buf backing the buffer. Subsequent mode-setting operations may trigger a segmentation fa...

CVE-2025-38468

CVE-2025-38468 in the Linux kernel affects the net/sched path where htb_lookup_leaf may trigger BUG_ON when handling an empty red-black tree during HTB dequeue. The described stack shows a sequence ending with a BUG_ON in htb_lookup_leaf, which is resolved by returning NULL from htb_lookup_leaf (...

CVE-2025-38480

CVE-2025-38480 : In the Linux kernel's Comedi subsystem, insn_rw_emulate_bits() may read uninitialized data for INSN_READ/INSN_WRITE when insn->n is 0, causing an incorrect write to digital outputs and potentially corrupting channel state. The fix returns 0 early when insn->n == 0, aligning...

CVE-2025-38497

CVE-2025-38497 (Linux kernel) affects usb gadget configfs: writing an empty string to the qw_sign or landingPage sysfs attributes can dereference page[l-1] before length validation, causing an OOB read. The fix adds an early length check in os_desc_qw_sign_store() and webusb_landingPage_store() t...

CVE-2003-0462

CVE-2003-0462 is a race condition in the Linux 2.4 kernel where env_start/env_end pointers used by the execve path (fs/proc/base.c) can lead to a local denial of service (kernel crash). Documented for several 2.4.x architectures (notably i386/alpha) and tracked in multiple advisories (e.g., Debia...

CVE-2005-3053

The CVE-2005-3053 issue is a Linux kernel 2.6.x local vulnerability where set_mempolicy accepts a negative first argument, triggering a BUG() and a potential denial of service. The Debian DSAs enumerate CVE-2005-3053 among several local/remote problems in kernel-source-2.6.8 and recommend upgradi...

CVE-2005-4605

CVE-2005-4605 concerns the Linux kernel procfs implementation. A signedness error in the proc_misc.c code (pre-2.6.15) allows a local attacker to read sensitive kernel memory by manipulating a signed value added to an unsigned value, disclosed via /proc interactions. Public reports document the a...

CVE-2006-1863

CVE-2006-1863 is a directory traversal vulnerability in CIFS on Linux 2.6.16 and earlier that allows a local user to escape chroot restrictions for an SMB-mounted filesystem via "..\" sequences. The issue is mitigated by applying a kernel update (e.g., as per ChangeLog-2.6.16.11). Mode: C (detail...

CVE-2007-0958

CVE-2007-0958 : In Linux kernel 2.6.x before 2.6.20, local users can read unreadable binaries by abusing the PT_INTERP interpreter mechanism, triggering a core dump. This is a local-privilege issue; the described impact is to read binaries via core-dump behavior. According to the changelog refere...

CVE-2008-2358

The CVE-2008-2358 entry concerns the Linux kernel DCCP module: an integer overflow in dccp_feat_change within net/dccp/feat.c on kernels 2.6.17–2.6.20 and 2.6.18, enabling a local attacker to trigger a heap-based buffer overflow and gain privileges. Connected advisories reference this issue as pa...

CVE-2008-3831

The CVE-2008-3831 entry concerns the i915 DRM driver in Linux kernel 2.6.24 (notable on Debian GNU/Linux) and OpenBSD. The root cause is that the DRM_I915_HWS_ADDR ioctl is not restricted to the DRM master due to the absence of the DRM_MASTER and DRM_ROOT_ONLY flags in the ioctl configuration. Th...

CVE-2008-4576

CVE-2008-4576 affects the Linux kernel SCTP implementation prior to 2.6.25.18. A remote attacker can trigger a denial of service by sending an INIT-ACK that states the peer does not support AUTH, causing sctp_process_init to clean up active transports and, when the T1-Init timer expires, to trigg...

CVE-2009-2767

CVE-2009-2767 affects the Linux kernel up to version 2.6.31-rc6. The init_posix_timers function in kernel/posix-timers.c mishandles CLOCK_MONOTONIC_RAW clock_nanosleep, triggering a NULL pointer dereference and enabling local users to cause a denial of service (OOPS) or potentially gain privilege...

CVE-2012-0055

CVE-2012-0055 concerns OverlayFS in the Linux kernel, affected in versions before 3.0.0-16.28 (as used in Ubuntu 10.04 LTS and 11.10). The vulnerability stems from missing inode security checks in OverlayFS, enabling an attacker to bypass security restrictions and perform unauthorized actions. Th...

CVE-2012-2745

CVE-2012-2745 affects the Linux kernel prior to 3.3.2. The copy_creds function in kernel/cred.c may provide an invalid replacement session keyring to a child process, allowing local users to cause a denial of service (panic) via a crafted fork. Affected: Linux kernel

CVE-2012-5375

Vulnerability CVE-2012-5375 affects the Linux kernel’s Btrfs CRC32C feature. Local users can cause a denial of service (blocking file creation) by writing to a victim’s directory and creating a file whose name hashes to a specific CRC32C value, with impact noted as CVE-2012-5375 in multiple advis...

CVE-2013-3235

Mitigation-ready summary for CVE-2013-3235: In the Linux kernel, net/tipc/socket.c prior to 3.9-rc7 does not initialize a certain data structure and a length variable, enabling local attackers to read sensitive data from kernel stack memory via crafted recvmsg/recvfrom. Affected scenario is local...

CVE-2017-0428

CVE-2017-0428 describes an elevation-of-privilege in the NVIDIA GPU driver that could allow a local malicious application to execute arbitrary code in kernel context on Android devices with Kernel-3.10. The Android entry notes an Android ID (A-32401526) and flags the issue as critical due to pote...

CVE-2017-0537

CVE-2017-0537 affects Android kernels with Kernel-3.18 and relates to the USB gadget driver. It enables a local attacker to disclose data outside their permissions after compromising a privileged process. Impact: partial confidentiality. No public fixes or remediation details are provided in the ...

CVE-2017-0627

The CVE-2017-0627 entry concerns an information-disclosure vulnerability in the Android kernel UVC driver (affecting Kernel-3.10 and Kernel-3.18). The vulnerability could let a local, privileged process access data outside its normal permissions. The description indicates the issue is triggered b...

CVE-2017-8069

CVE-2017-8069 affects the Linux kernel 4.9.x (prior to 4.9.11). The issue lies in drivers/net/usb/rtl8150.c interacting incorrectly with CONFIG_VMAP_STACK, which may allow a local user to trigger a denial of service (system crash or memory corruption) or other impact by abusing a DMA scatterlist ...

CVE-2018-1000028

CVE-2018-1000028 is a Linux kernel vulnerability affecting kernels released after commit bdcf0a423ea1 (examples: 4.15-rc4+, 4.14.8+, 4.9.76+, 4.4.111+). It describes an Incorrect Access Control flaw in the NFS server (nfsd) that can let remote attackers read or write files they should not access ...

CVE-2020-36789

The CVE-2020-36789 entry pertains to the Linux kernel CAN stack. A driver calling can_get_echo_skb() in hardware IRQ context could trigger WARN_ON(in_irq) in skb_release_head_state() under congestion, risking NULL pointer dereference. Root cause: kfree_skb() used instead of the IRQ-safe path in n...

CVE-2021-47158

CVE-2021-47158 affects the Linux kernel’s net: dsa: sja1105 code path, specifically sja1105_setup() and its helpers (sja1105_static_config_load(), sja1105_clocking_setup(), sja1105_devlink_setup()). The root cause is missing cleanup when these steps fail, which could lead to memory leaks if the f...

CVE-2021-47189

CVE-2021-47189 relates to a Linux kernel issue in btrfs memory ordering between normal and ordered work functions. Ordered work may be processed by a different thread than normal work; synchronization relied on WORK_DONE_BIT, but existing bitops did not guarantee ordering. Affected behavior obser...

CVE-2021-47246

CVE-2021-47246 affects the Linux kernel, specifically the mlx5e (Mellanox) networking path. The issue arises when adding a hairpin flow: a firmware-side send queue is created for the peer net device and reserves host memory pages for its ring buffer. If the peer device is removed/unbound before t...

CVE-2021-47276

The CVE-2021-47276 issue affects the Linux kernel’s ftrace on arm64, where -EINVAL could trigger ftrace_bug() to read the instruction pointer value from an invalid address, causing a kernel panic. The root cause was reading the ip address directly from memory when reporting the error. The remedy ...

CVE-2021-47308

CVE-2021-47308 affects the Linux kernel bug in the SCSI libfc code: fc_rport_prli_resp() could index out of bounds. The issue is resolved in the kernel via fixes in the stable/maintained commits listed in the CVE references (e.g., a4a54c54..., 8511293e..., 4921b161...). The CVSSv3.1 base score is...

CVE-2021-47361

CVE-2021-47361 – Linux kernel mcb_alloc_bus() use-after-free fix. The vulnerability arises from two bugs in mcb_alloc_bus(): (1) calling put_device(carrier) after ida_simple_get() failure without a prior get_device(), risking use-after-free; (2) not balancing device lifecycles after device_initia...

CVE-2021-47387

CVE-2021-47387 is a Linux kernel vulnerability in the cpufreq: schedutil governor related to freeing sugov_tunables. The original sugov_tunables_free() was split: sugov_clear_global_tunables() clears the global_tunables, and a new sugov_tunables_free() is used as kobj_type::release to safely free...

CVE-2021-47422

CVE-2021-47422 affects the Linux kernel’s drm/nouveau/kms/nv50- component. The issue is a memory leak where an op allocated by single_open() is not freed if single_release() is not called. The vulnerability is described as a local-privilege context with a potential availability impact, with CVSS ...

CVE-2021-47430

CVE-2021-47430 concerns a Linux kernel issue related to SMAP handling on x86. The vulnerability arises in x86/entry where the OS may warn when AC is active in user mode, even if SMAP is disabled or partially disabled, leading to a conditional warning that could fire on machines that support SMAP ...

CVE-2022-48667

The connected documents confirm CVE-2022-48667 affects the Linux kernel SMB3 insert-range path, where an affected cached region is not discarded, risking temporary file data corruption. The issue has been fixed in kernel code (see related commits and advisories from Astra Linux, SUSE, Microsoft, ...

CVE-2022-48691

CVE-2022-48691 is a Linux kernel vulnerability affecting nf_tables offload hook handling. The issue arises from clean up of the hook list when offload flag checks fail, enabling a memory leak of an unreferenced object and preventing nft_chain_release_hook() from freeing hooks. The connected Nessu...

CVE-2022-48720

The CVE-2022-48720 issue in the Linux kernel affects the macsec netdev offload path. The root cause is that NETDEV_UNREGISTER handling in the macsec netdev notify path released only software resources, leaving macsec HW offload resources under the underlay driver uncleaned, causing a resource lea...

CVE-2022-48728

CVE-2022-48728 corresponds to a Linux kernel flaw in IB/hfi1: Fix AIP early init panic. The issue is a NULL pointer dereference triggered by an early failure in hfi1_ipoib_setup_rn(), causing a NULL dereference in hfi1_ipoib_txreq_deinit() during netdev destruction. The root cause is a NULL deref...

CVE-2022-48734

CVE-2022-48734 affects the Linux kernel in the btrfs subsystem. The issue is a deadlock caused by quota disable interactions with the qgroup rescan worker and other transactions (e.g., block group relocation) when quota is disabled. The described sequence involves Task A starting a transaction an...

CVE-2022-48748

CVE-2022-48748 affects the Linux kernel networking path for bridges with VLANs. The issue is a memory leak in the bridge VLAN path (net: bridge: vlan: fix memory leak in __allowed_ingress). When per-vlan state is used and vlan snooping/stats are disabled, untagged or priority-tagged ingress frame...

CVE-2022-48759

CVE-2022-48759 describes a race in the Linux kernel between releasing rpmsg_ctrldev and its associated cdev, potentially freeing rpmsg_ctrldev before the cdev is fully released. The issue affects rpmsg_ctrldev which includes a struct cdev; freeing the rpmsg_ctrldev via rpmsg_ctrldev_release_devic...

CVE-2022-48763

CVE-2022-48763 relates to the Linux kernel KVM/x86 nested virtualization when SMM state is toggled. The issue occurs if userspace forces a vCPU out of SMM during post-VMXON and injects an SMI, causing vmx_enter_smm() to overwrite vmx->nested.smm.vmxon and leave vmxon and smm.vmxon false while ...

CVE-2022-48808

CVE-2022-48808 concerns a Linux kernel issue in DSA (dpaa2-eth) handling. On systems with LX2160A and Marvell DSA switches, rebooting while the DSA master is up could panic due to the master’s deregistration triggering NETDEV_GOING_DOWN and attempting to close slave interfaces after they were alr...

CVE-2022-48818

The CVE-2022-48818 entry refers to a Linux kernel issue in the MDIO/MV88E6xxx DSA path where devres usage around mdiobus led to a kernel OOPS during shutdown. The root cause is interaction between devm_mdiobus_free() and devres_release_all() if the MDIO bus is unregistered late due to a shutdown‑...

CVE-2022-48822

CVE-2022-48822 — Linux kernel usb f_fs use-after-free (epfile) Technical summary: A race between ffs_func_eps_disable (which uses a local copy of epfiles) and ffs_epfile_release can lead to use-after-free of the epfile read buffer. While ffs_epfile_release frees the buffer and destroys ffs->ep...

CVE-2022-48834

CVE-2022-48834 refers to a Linux kernel issue in the usb: usbtmc driver where usbtmc_ioctl_request incorrectly used usb_rcvctrlpipe() for all transfers (in or out). The fix separates control transfers by direction. The vulnerability impact described is a local issue tied to incorrect control pipe...

CVE-2022-48860

CVE-2022-48860 affects the Linux kernel ethernet xemaclite_of_probe. The issue is a refcount leak from of_parse_phandle() that is addressed by calling of_node_put() in the probe/remove path. Impact is locally accessible with high availability risk stated; no exploitation details provided in the c...