CVE-2024-26732

CVE-2024-26732 affects the Linux kernel where SO_PEEK_OFF for sockets could cause a lockdep violation in af_unix, due to per-socket uio lock usage. The vulnerability arises because SO_PEEK_OFF was previously protected by kernel locks; a patch implemented lockless behavior for setsockopt(SO_PEEK_O...

CVE-2023-22999

The CVE-2023-22999 issue affects the Linux kernel prior to 5.16.3, specifically the drivers/usb/dwc3/dwc3-qcom.c path. The root cause is that dwc3_qcom_create_urs_usb_platdev’s return value is misinterpreted in error cases (expected NULL but it is an error pointer), leading to an incorrect handli...

CVE-2023-52746

In the Linux kernel, the following vulnerability has been resolved: xfrm/compat: prevent potential spectre v1 gadget in xfrm_xlate32_attr() int type = nla_type(nla); if (type > XFRMA_MAX) {return -EOPNOTSUPP;} @type is then used as an array index and can be usedas a Spectre v1 gadget. if (nla_...

CVE-2023-52750

The CVE-2023-52750 entry concerns the Linux kernel on arm64 where CPU_BIG_ENDIAN must be restricted to using a trusted assembler (GNU as or LLVM IAS 15.x or newer). Before LLVM 15, LLVM’s integrated assembler could byte-swap NOPs for big-endian targets, causing a sequence of bytes that matched th...

CVE-2023-52794

CVE-2023-52794 is a Linux kernel vulnerability in the intel_powerclamp implementation under thermal: intel: powerclamp, where a mismatch between param_get_int and the max_idle definition can trigger a global out-of-bounds read (KASAN report). The bug stems from reading a 32-bit int where a smalle...

CVE-2023-52871

CVE-2023-52871 concerns the Linux kernel’s soc: qcom: llcc driver. The issue arises when a second llcc device exists: a failed probe could overwrite the global drv_data pointer, risking data corruption. The fixed description: validate drv_data before overwriting it. Affected context in connected ...

CVE-2023-52874

CVE-2023-52874 (Linux kernel) concerns x86/tdx: after TDCALL, RSI was not cleared when zeroing the guest-visible register bitmap in the TDX_HYPERCALL path. The description notes the RSI bit was present in the bitmap when first added, removed later, and subsequently not XORed back after a pop RSI ...

CVE-2023-52928

CVE-2023-52928 concerns the Linux kernel’s BPF verifier. According to connected sources, the issue arises from the verifier’s handling of invalid kfunc calls in backtrack_insn, where such an instruction could be captured by fixup_kfunc_call() and, if not eliminated by DCE, trigger a warning in ba...

CVE-2023-53139

The CVE-2023-53139 issue is in the Linux kernel’s NFC FDP code: it adds a null check for devm_kmalloc_array in fdp_nci_i2c_read_device_properties. If devm_kmalloc_array fails and fw_vsc_cfg is NULL, an out-of-bounds write can occur in device_property_read_u8_array. The vulnerability is addressed ...

CVE-2024-26658

Consolidated details from multiple connected sources confirm CVE-2024-26658 affects the bcachefs Linux kernel module and describes a deadlock risk during snapshot creation. The root cause is the unconditional acquisition of s_umount during subvolume snapshot operations, which can deadlock with ex...

CVE-2024-26753

CVE-2024-26753 is a Linux kernel vulnerability in crypto: virtio/akcipher where a stack overflow occurs when copying from a stack-allocated virtio_crypto_akcipher_session_para into the union in virtio_crypto_op_ctrl_req. The issue is caused by sizeof(struct virtio_crypto_akcipher_session_para) be...

CVE-2024-35916

In the Linux kernel, the following vulnerability has been resolved: dma-buf: Fix NULL pointer dereference in sanitycheck() If due to a memory allocation failure mock_chain() returns NULL, it ispassed to dma_fence_enable_sw_signaling() resulting in NULL pointerdereference there. Call dma_fence_ena...

CVE-2024-35974

CVE-2024-35974 affects the Linux kernel block subsystem. The vulnerability arises from a q->blkg_list corruption introduced when multiple gendisk instances are allocated for a single request queue during disk rebind, allowing a blkg to linger in q->blkg_list during blkcg_init_disk() and thu...

CVE-2024-36001

Mode C (detailed). CVE-2024-36001 affects the Linux kernel netfs write path for buffered files under write-through caching. The root cause: in netfs_perform_write(), when a file is marked for writethrough or O_*SYNC/RWF_*SYNC, the code previously skipped the flush and wait if writing at/above EOF...

CVE-2024-39296

CVE-2024-39296 affects the Linux kernel bonding subsystem. The issue is a race during module removal (rmmod bonding) caused by a removed NULL check in the bonding debugfs cleanup path, which can lead to an oops in bond_uninit()/bond_debug_unregister() via debugfs_remove or recursive removal. The ...

CVE-2024-40969

CVE-2024-40969 (Linux kernel, f2fs) is confirmed to affect the f2fs shutdown path. The root cause is that shutdown does not verify the thaw error when the filesystem is read-only, which can lead to a deadlock during shutdown (via s b_start_write, set RO, and then thaw). The available connected do...

CVE-2024-42242

In CVE-2024-42242, the Linux kernel mmc: sdhci driver had a mismatch between two checks for max_segment_size. max_size was forced to PAGE_SIZE by blk_queue_max_segment_size() when it was below PAGE_SIZE, while blk_validate_limits() treated a max_segment_size below PAGE_SIZE as an error (returning...

CVE-2024-43877

The CVE-2024-43877 vulnerability affects the Linux kernel’s media: pci: ivtv implementation. When DMA mapping fails, dma->SG_length can be 0, and code later accesses dma->SGarray[dma->SG_length - 1], causing an out-of-bounds read. The fix adds an early return on invalid DMA map results a...

CVE-2024-56646

Technical details about CVE-2024-56646 are not provided in the supplied documents. Monitor official advisories for affected products, impact, and fixes.

CVE-2024-57928

CVE-2024-57928 (Linux kernel) : The vulnerability is in netfs buffered reads. When netfs_read_to_pagecache() encounters an error from either ->prepare_read() or netfs_prepare_read_iterator(), it must decrement ->nr_outstanding, cancel the subrequest, and break the issuing loop. The patch fi...

CVE-2025-37837

CVE-2025-37837 addresses warnings in the Linux kernel: iommu/tegra241-cmdqv dmam_free_coherent() warnings during SMMU rollback and a memory-usage warning (128 pages) from free_contig_range, traced to devres-managed LVCMDQ resources freed by devm_action_release. The fix removes the unwind path in ...

CVE-2025-37863

CVE-2025-37863 affects the Linux kernel overlayfs (ovl). The issue arises when a data-only layer is pointed to by an upper layer, something not currently used but previously allowed only via the datadir+ feature, which could trigger an Oops. The documented fix disables datadir without a lowerdir,...

CVE-2025-38037

The CVE-2025-38037 issue affects the Linux kernel’s VXLAN FDB handling. The root cause is a data race where the FDB entry’s fields used and updated may be concurrently accessed by multiple threads, triggering KCSAN reports in vxlan_xmit paths. The fix is to annotate these accesses with READ_ONCE(...

CVE-2025-38143

CVE-2025-38143 (Linux kernel) is addressed in Azure Linux 3.0 by a patch that fixes a NULL-dereference in backlight pm8941 when devm_kasprintf() returns NULL. The issue occurs in wled_configure() due to a missing NULL check after allocation. The fix adds the necessary NULL check after devm_kaspri...

CVE-2025-38147

Technical details about CVE-2025-38147 (affected software, impact, exploitability, and fix specifics) are not publicly provided in the supplied documents. Please monitor for updates from vendors and security bulletins.

CVE-2025-38184

CVE-2025-38184 : In the Linux kernel, a null-ptr-deref can occur when acquiring the remote IP for an Ethernet bearer in the TIPC subsystem. Reproduction involves creating a tun interface, enabling an L2 bearer, and using TIPC_NL_UDP_GET_REMOTEIP with media name set to tun, which can trigger a gen...

CVE-2025-38185

CVE-2025-38185 (Linux kernel) : The vulnerability in the ATM subsystem (atm/atmtcp.c) arises from freeing an skb with an invalid length in atmtcp_c_send(). The code checks skb->len == 0 but does not fully guard against using skb->data as an atmtcp_hdr when len is non-zero, and when len == 0...

CVE-2025-38215

In CVE-2025-38215, the Linux kernel fbdev subsystem had a null-ptr-deref risk in fb_videomode_to_var when do_register_framebuffer allocated fb_videomode memory unsuccessfully. The fix prevents registering fb_info unless its mode is set and moves fb_add_videomode() earlier in do_register_framebuff...

CVE-2025-38260

CVE-2025-38260 concerns a Linux kernel bug in Btrfs where a corrupted csum (checksum) tree root could lead to a crash when mounting with rescue=ibadroots. The provided description details that normally this option should set BTRFS_FS_STATE_NO_DATA_CSUMS to skip csum searches for future data reads...

CVE-2025-38297

CVE-2025-38297: In the Linux kernel, a division-by-zero could occur in em_compute_costs() for non-CPU devices due to uninitialized table[i].performance. The fix adds a _is_cpu_device(dev) check to em_init_performance() paths to prevent the division. Public advisories (e.g., openSUSE SUSE-SU-2026:...

CVE-2025-38406

CVE-2025-38406 affects the Linux kernel wifi driver ath6kl: the vulnerability originates from an unnecessary WARN_ON() when firmware input is bad. The description clarifies that bad firmware input is unrelated to the driver stack and does not constitute an exploitable condition; the fix instead p...

CVE-2025-38420

CVE-2025-38420 ffecting the Linux kernel’s wifi Carl9170 driver. The issue occurs when the device that failed firmware loading is pinged; since ieee80211_register_hw() fails, the internal workqueue created by ieee80211_queue_work() is not yet present, causing a null pointer dereference if a queue...

CVE-2025-38481

Technical details for CVE-2025-38481 are not provided in the connected documents. The initial description notes a comedi kernel fix (n_insns limit) but contains no vendor/product/version/exploit details beyond that.

CVE-2026-22992

Mode C: The CVE-2026-22992 issue affects the Linux kernel’s libceph stack. Root cause: mon_handle_auth_done() no longer propagates errors from ceph_auth_handle_reply_done(), so a failure during authentication could be misinterpreted by higher layers while msgr2 proceeds with session setup. Potent...

CVE-2026-23003

CVE-2026-23003 : In the Linux kernel’s IPv6 tunnel receive path (ip6_tunnel, __ip6_tnl_rcv), VLAN encapsulations were not handled correctly due to a failed VLAN-aware pull in the decapsulation path. The fix substitutes skb_vlan_inet_prepare() for pskb_inet_may_pull() to properly accommodate VLAN-...

CVE-2026-23234

CVE-2026-23234 affects the Linux kernel F2FS subsystem. A use-after-free can occur in f2fs_write_end_io() due to a race with kill_f2fs_super freeing sbi before writeback complete, allowing access to freed sbi during page cache/inode cleanup. The published fix relocates the checkpoint thread wakeu...

CVE-2026-31787

CVE-2026-31787 affects the Linux kernel, specifically the xen/privcmd mapping flow. The root cause is a double-free in the VMA splitting path when userspace performs partial munmap() on a privcmd mapping. Because privcmd_vm_ops defines .close but not .may_split or .open, the kernel may_split() pe...

CVE-1999-0138

CVE-1999-0138 affects the suidperl and sperl programs, which do not relinquish root privileges when reverting UIDs to the original user. This can grant root access with impact on confidentiality, integrity, and availability as described (local, low complexity, no auth required). The vulnerability...

CVE-1999-0656

The CVE-1999-0656 issue affects the ugidd RPC interface and allows remote enumeration of valid usernames by querying arbitrary UIDs mapped to local user/group names. Connected documents indicate affected kernel packages in Linux distributions (e.g., CBL Mariner and Red Hat-sourced advisories) wit...

CVE-2005-0756

CVE-2005-0756 affects Linux kernel 2.6.8.1 on the amd64 platform, where ptrace() does not properly verify addresses, allowing a local attacker to crash the kernel (denial of service). The issue is reiterated across multiple advisories (Red Hat/CentOS RHSA-2005:514, Debian DSA-922/DSA-921, etc.), ...

CVE-2006-4997

CVE-2006-4997 involves the Linux kernel ATM subsystem (clip_mkip in net/atm/clip.c). The issue allows a remote attacker to trigger a denial of service (panic) by causing the ATM subsystem to dereference memory of socket buffers after they have been freed. This is triggered by memory access patter...

CVE-2007-1592

The CVE-2007-1592 vulnerability affects the Linux kernel (2.6.x up to 2.6.21-rc3) in net/ipv6/tcp_ipv6.c, where ipv6_fl_socklist is inadvertently shared from a listening IPv6 socket to child sockets. This can allow a local user to cause a denial of service (OOPS) or a double free by attaching a f...

CVE-2007-3731

CVE-2007-3731 affects the Linux kernel 2.6.20/2.6.21. The vulnerability arises from handling an invalid LDT segment selector in %cs during ptrace single-step operations, enabling a local user to trigger a NULL pointer dereference and an OOPS, via PTRACE_SETREGS and PTRACE_SINGLESTEP (TRACE_IRQS_O...

CVE-2007-3740

CVE-2007-3740 describes a flaw in the CIFS filesystem of the Linux kernel prior to 2.6.22 where Unix extension support can fail to honor the process umask, enabling a local user to gain privileges. Affected are kernels with CIFS Unix extensions enabled; impact is local privilege escalation. Remed...

CVE-2009-4021

CVE-2009-4021 affects the fuse_direct_io function in fs/fuse/file.c of the Linux kernel (fuse subsystem) prior to 2.6.32-rc7, enabling a potential denial of service via invalid pointer dereference possibly tied to memory consumption. Affected environment examples in connected documents include Mi...

CVE-2010-0003

The connected document confirms CVE-2010-0003 affects the Linux kernel (i386) before 2.6.32.4, where the print_fatal_signal path in kernel/signal.c can let local users read arbitrary memory by jumping to an address and reading a log, with potential DoS via the same jump. This is associated with t...

CVE-2010-0291

CVE-2010-0291 is a Linux kernel local privilege/escalation/DoS issue described in connected advisories as affecting the kernel before 2.6.32.4. The vulnerability stems from the do_mremap/mmap handling, allowing local users to gain privileges or trigger a panic. The MiracleLinux AXSA:2010-377:12 a...

CVE-2010-1087

CVE-2010-1087 affects the Linux kernel family 2.6.x up to 2.6.33-rc5. The vulnerability is in nfs_wait_on_request (fs/nfs/pagelist.c) and can cause a denial of service (kernel OOPS) via unknown vectors related to truncating a file and an operation that is not interruptible. The impact is a DoS on...

CVE-2010-4074

CVE-2010-4074 affects Linux kernel USB subsystem prior to 2.6.36-rc5, where several structure members were not properly initialized. This can let local users read potentially sensitive data from kernel stack memory via TIOCGICOUNT-related ioctl paths, specifically mos7720_ioctl and mos7840_ioctl ...

CVE-2010-4565

CVE-2010-4565 affects the Linux kernel CAN implementation (bcm_connect in net/can/bcm.c) on 2.6.36 and earlier, where a publicly accessible file is created with a filename containing a kernel memory address. This filename exposure can allow local attackers to glean potentially sensitive informati...