CVE-2025-38420

CVE-2025-38420 ffecting the Linux kernel’s wifi Carl9170 driver. The issue occurs when the device that failed firmware loading is pinged; since ieee80211_register_hw() fails, the internal workqueue created by ieee80211_queue_work() is not yet present, causing a null pointer dereference if a queue...

CVE-2025-38066

CVE-2025-38066 affects the Linux kernel in the dm-cache subsystem (policy SMQ). The issue arises when a cache device fails to resume due to mapping errors and a resumed operation is retried, which can leave a partially initialized policy object and trigger a BUG_ON during mapping reload. The conn...

CVE-2025-38067

CVE-2025-38067 : In the Linux kernel, the rseq registration path could segfault if the user-space rseq_cs field is non-zero. The field is supposed to be set to 0 before registration, but this wasn’t enforced, allowing a faulty rseq_cs value to cause a segfault when returning to user-space. The fi...

CVE-2025-38173

CVE-2025-38173 affects the Linux kernel crypto path (marvell/cesa) in Mariner builds, specifically for kernel packages older than 6.6.96.1-1. The issue is described as handling zero-length skcipher requests to avoid accessing random memory; the fix returns 0 for zero-length requests. A patched ke...

CVE-2025-38191

Summary: The Linux kernel ksmbd component has a null-pointer dereference in destroy_previous_session during Kerberos session setup when PreviousSessionId is used. The root cause is that sess->user is not yet set, allowing a NULL user to be passed to destroy_previous_session. Fix: The patch def...

CVE-2025-38194

CVE-2025-38194 affects the Linux kernel’s JFFS2 file system. The issue arises when jffs2_sum_write_sumnode does not validate the return value of jffs2_prealloc_raw_node_refs, allowing an preallocation error to propagate into jffs2_link_node_ref and potentially cause a kernel BUG at fs/jffs2/nodel...

CVE-2025-38215

In CVE-2025-38215, the Linux kernel fbdev subsystem had a null-ptr-deref risk in fb_videomode_to_var when do_register_framebuffer allocated fb_videomode memory unsuccessfully. The fix prevents registering fb_info unless its mode is set and moves fb_add_videomode() earlier in do_register_framebuff...

CVE-2025-38217

The CVE-2025-38217 issue is in the Linux kernel hwmon code path: fts_read() for hwmon_pwm_auto_channels_temp. The bug is a TOCTOU race on data->fan_source[channel], which can be read twice without locking, allowing a change to FTS_FAN_SOURCE_INVALID (0xff) between checks and use, potentially c...

CVE-2025-38244

The CVE-2025-38244 issue affects the Linux kernel’s SMB client, specifically the CIFS deadlock when reconnecting channels. The vulnerability stems from incorrect lock ordering in cifs_signal_cifsd_for_reconnect(), which could create a circular locking dependency among tcp_ses->srv_lock, ret_bu...

CVE-2025-38304

CVE-2025-38304 : In the Linux kernel, a NULL pointer dereference in Bluetooth eir_get_service_data (len parameter can be NULL) is fixed. The vulnerability affects the Bluetooth EIR handling path and is rated with LOCAL attack vector and HIGH availability impact, implying potential kernel crash or...

CVE-2025-38337

CVE-2025-38337 : Linux kernel data-race in jbd2_journal_dirty_metadata leading to potential null dereference of handle->h_transaction. The issue arises because handle may be NULL and is not checked before dereferencing, allowing a data race between jbd2_journal_dirty_metadata and ext4/jbd2 han...

CVE-2025-38345

CVE-2025-38345: Linux kernel ACPICA ACPI operand cache leak in dswstate.c fixed by ACPICA patch (commit 987a3b5c...). Root cause: miscalculated stack top in acpi_ds_obj_stack_pop_and_delete() vs acpi_ds_obj_stack_push(), leading to kmem_cache_destroy Acpi-Operand memory leak during early terminat...

CVE-2025-38363

CVE-2025-38363 : In the Linux kernel, a null pointer dereference could occur in the Tegra DRM driver. Specifically, in tegra_crtc_reset(), memory allocated with kzalloc() is not checked for failure; before calling __drm_atomic_helper_crtc_reset, the CRTC state should be validated to prevent deref...

CVE-2025-38403

Summary (CVE-2025-38403) : In the Linux kernel, the vmci transport path (vsock/vmci) had a fix to clear the vmci_transport_packet before populating fields in vmci_transport_packet_init to avoid leaving uninitialised data. This change addresses an information leakage/contamination risk related to ...

CVE-2025-38428

CVE-2025-38428 : In the Linux kernel, the vulnerability affects the ims-pcu path where the firmware-provided length (len) is used in memcpy to fragment data in ims_pcu_flash_firmware(). If len is too large, memory corruption can occur. The issue arises from trusting firmware input; the fixed vers...

CVE-2025-38467

CVE-2025-38467 affects the Linux kernel DRM/Exynos driver (exynos7_drm_decon). A race condition could cause a kernel NULL pointer dereference during boot when a secondary console device (e.g., TTY serial) is present, leading to a panic. The fix adds a guard to validate that the DRM device can han...

CVE-2025-38482

CVE-2025-38482 : In the Linux kernel, the comedi das6402 IRQ check used an unchecked user-supplied value for the shift amount, allowing a negative or out-of-range shift. The test now requires it->options[1] to be within bounds before applying the test, with valid IRQ values in [1,15] and 0 dis...

CVE-1999-0138

CVE-1999-0138 affects the suidperl and sperl programs, which do not relinquish root privileges when reverting UIDs to the original user. This can grant root access with impact on confidentiality, integrity, and availability as described (local, low complexity, no auth required). The vulnerability...

CVE-2006-3626

CVE-2006-3626 is a local-privilege-escalation flaw in the Linux kernel (affected: 2.6.17.4 and earlier) caused by a race in the proc filesystem via prctl(PR_SET_DUMPABLE) that can set /proc/self/environ to setuid root. Exploitation would require local access and is not described as remote. The is...

CVE-2006-4145

CVE-2006-4145 affects the Linux kernel UDF filesystem driver (2.6.17 and earlier). The issue allows a local user to trigger a hang or crash by performing operations on truncated files (illustrated via dd). Public documents in connected feeds confirm this CVE and indicate that updated kernel packa...

CVE-2006-5619

The CVE-2006-5619 issue is a Linux kernel 2.6.x vulnerability (up to 2.6.18-stable) where the /proc/net/ip6_flowlabel path handling can trigger an infinite loop while searching for flowlabels, allowing local users to cause a denial of service (hang or oops). Affected components are the ip6_fl_get...

CVE-2007-0771

CVE-2007-0771 concerns the Linux kernel utrace support (notably in 2.6.18 and related 2.6.x lines) where local attackers can trigger a DoS via a race/spin failure between utrace_attach and related code paths when using ptrace (as exemplified by the ptrace-thrash scenario). The vulnerability manif...

CVE-2007-3848

CVE-2007-3848 affects the Linux kernel (notably 2.4.35 and other versions) by allowing a local user to send arbitrary signals to a higher-privilege child process via a setuid-root parent dying and delivering an attacker-controlled death signal (PR_SET_PDEATHSIG). The issue is listed in advisories...

CVE-2009-1897

The CVE affects the Linux kernel tun/tun_chr_poll path: the tun_chr_poll function in drivers/net/tun.c for Linux kernel versions 2.6.30 and 2.6.30.1. The underlying issue is that, when the -fno-delete-null-pointer-checks option is omitted, a NULL pointer dereference can be triggered via a NULL de...

CVE-2010-1085

CVE-2010-1085 affects the Linux kernel before 2.6.32.x/2.6.33-rc4 on the AMD780V chipset. The vulnerability is in the azx_position_ok function in hda_intel.c, where certain inputs can trigger a divide-by-zero and cause a crash (DoS). Public advisories from MiracleLinux and Oracle Linux list this ...

CVE-2010-2478

CVE-2010-2478: The Linux kernel before 2.6.33.7 on 32-bit platforms has an integer overflow in ethtool_get_rxnfc(), triggered by a large info.rule_cnt via ETHTOOL_GRXCLSRLALL. Local users can cause a denial of service or potentially other impact (as described in the connected Mirage/Linux advisor...

CVE-2010-4161

CVE-2010-4161 affects the Linux kernel 2.6.18 build used by Red Hat Enterprise Linux 5. The issue lies in udp_queue_rcv_skb in net/ipv4/udp.c, where a crafted socket filter and UDP traffic can trigger a denial of service (deadlock/system hang). The related CVE-2010-4158 is referenced. Connected d...

CVE-2012-0055

CVE-2012-0055 concerns OverlayFS in the Linux kernel, affected in versions before 3.0.0-16.28 (as used in Ubuntu 10.04 LTS and 11.10). The vulnerability stems from missing inode security checks in OverlayFS, enabling an attacker to bypass security restrictions and perform unauthorized actions. Th...

CVE-2013-4270

CVE-2013-4270 affects the Linux kernel: the net_ctl_permissions function in net/sysctl_net.c may misdetermine uid/gid, allowing a local user to bypass /proc/sys/net restrictions. Affected: kernels before 3.11.5 (reported in EulerOS advisories and Nessus/OpenVAS listings). Impact is local privileg...

CVE-2013-4515

The CVE-2013-4515 issue affects the Linux kernel (pre-3.12) in the bcm_char_ioctl path (drivers/staging/bcm/Bcmchar.c). The root cause is failure to initialize a data structure, enabling local attackers to read sensitive kernel memory via the IOCTL_BCM_GET_DEVICE_DRIVER_INFO interface. Impact is ...

CVE-2013-7269

The CVE-2013-7269 vulnerability affects the Linux kernel (affected area: net/netrom/af_netrom.c) before 3.12.4. The issue arises when nr_recvmsg updates a length value without ensuring the associated data structure is initialized, enabling local attackers to read kernel memory via recvfrom, recvm...

CVE-2016-3135

CVE-2016-3135 is an integer overflow in xt_alloc_table_info (net/netfilter/x_tables.c) of the Linux kernel up to 4.5.2 on 32-bit platforms, enabling local privilege escalation or heap corruption leading to DoS via IPT_SO_SET_REPLACE. Connected documents corroborate the 32-bit overflow in xt_alloc...

CVE-2016-6187

CVE-2016-6187 : The Linux kernel before 4.6.5 contains a vulnerability in the AppArmor LSM path. The function apparmor_setprocattr in security/apparmor/lsm.c does not validate the buffer size, enabling a local user to gain privileges by triggering a setprocattr hook. This is a local privilege-esc...

CVE-2017-17052

The CVE-2017-17052 entry affects the Linux kernel: the mm_init function in kernel/fork.c fails to clear the ->exe_file field of a new process’s mm_struct. This can enable a local attacker to trigger a use-after-free (and potential additional impact) by running a crafted program. Affected path ...

CVE-2017-18261

CVE-2017-18261 : The issue is in the Linux kernel, specifically the arch_timer_reg_read_stable macro in arch/arm64/include/asm/arch_timer.h, with versions before 4.13. It allows a local user to trigger a denial of service (infinite recursion) by writing to a file under /sys/kernel/debug in certai...

CVE-2021-3736

CVE-2021-3736 affects the Linux kernel in mbochs_ioctl within samples/vfio-mdev/mbochs.c used by VFIO mediated devices. The flaw is a memory leak that could allow a local attacker to leak internal kernel information. Some sources note a patched kernel package (e.g., kernel 5.10.131.1-1 in Mariner...

CVE-2021-47091

CVE-2021-47091 affects the Linux kernel mac80211 component. Root cause: locking in ieee80211_start_ap error path where local channel context release wasn’t guaranteed to hold local->mtx, risking improper synchronization. The fix enforces holding local->mtx when releasing the channel context...

CVE-2021-47143

CVE-2021-47143 affects the Linux kernel net/smc subsystem. The root cause was missing cleanup when a smcd_dev device_add() failed, leaving the device in smcd_dev_list and later freeing it, causing a corrupted list. The fix adds error handling to remove the device from the list on device_add() fai...

CVE-2021-47146

CVE-2021-47146 concerns the Linux kernel where mld_newpack could panic when headroom is large because high-order page allocation was disallowed (skb_put() path). The issue is triggered during IPv6 multicast handling in mld_newpack/mld_send_initial_cr and can lead to a kernel crash; the provided t...

CVE-2021-47216

CVE-2021-47216 affects the Linux kernel SCSI AdvanSys driver. The root cause is a kernel pointer leak caused by printing pointers cast to unsigned long with %lx instead of using %p/%px. A patch fixes the issue by changing pointer printing format from %lx to %p, effectively printing the hashed poi...

CVE-2021-47252

CVE-2021-47252 affects the Linux kernel batman-adv subsystem. The soft/batadv interface for a queued OGM could be modified between queuing and transmission, with WARN_ON used for kernel bugs rather than warnings. The vulnerability’s description and fixes are documented in connected advisories; th...

CVE-2021-47296

CVE-2021-47296 corresponds to a Linux kernel KVM PPC issue: vcpu_load leak where vcpu_put is not called if a user copy fails, risking preempt notifier corruption and system crashes. Connected documents (Astra Linux bulletin and related security advisories) confirm a patch has been applied to fix ...

CVE-2021-47329

CVE-2021-47329 affects the Linux kernel driver for Megaraid SAS (scsi: megaraid_sas). The issue is a resource leak: if probe fails during PCI device initialization, resources allocated by scsi_add_host() or megasas_start_aen() are not fully cleaned up, potentially leaving allocated resources unre...

CVE-2021-47365

The CVE-2021-47365 issue affects Linux kernel afs: a loop in afs_extend_writeback() could leak pages when expanding a writeback, due to removing the cleanup loop after switching from find_get_pages_contig() to xarray scanning. The fix adds an early-break handling that places the page on a referen...

CVE-2021-47463

CVE-2021-47463 concerns a Linux kernel NULL pointer dereference in mm/secretmem during GUP operations. The issue arises from dereferencing page->mapping without ensuring it is non-NULL as a page mapping can be nulled while gup() runs (e.g., by reclaim or truncation). A fix was implemented to ...

CVE-2021-47525

CVE-2021-47525 affects the Linux kernel, specifically the serial liteuart driver. The issue is a use-after-free and memory leak that occurs on unbind, where the port may remain registered after driver data is released, leading to potential use after free and serial-core memory leaks. The publishe...

CVE-2021-47620

CVE-2021-47620 affects the Linux kernel Bluetooth subsystem. The vulnerability arose from an out-of-bounds read in the malicious advertising data check, observed at the end of the while num_reports loop. A guard was added at the beginning of loop processing to ensure the pointer isn’t advanced be...

CVE-2022-48712

CVE-2022-48712 affects the Linux kernel ext4 subsystem. The advisory states that ext4: fix error handling in ext4_fc_record_modified_inode() does not fully handle krealloc() error cases, which could lead to silent memory corruption or a kernel bug. The fix patches the error handling in ext4_fc_re...

CVE-2022-48756

CVE-2022-48756 relates to the Linux kernel DRM MSM DSI driver. The vulnerability stems from an invalid parameter check in msm_dsi_phy_enable where the function uses the PHY input before validating it, risking a NULL pointer dereference. The fix is to initialize the dev variable after performing t...

CVE-2022-48793

CVE-2022-48793 affects the Linux kernel KVM/x86 nested migration path. The root cause is a NULL dereference caused by calling nested_svm_load_cr3 before Nested Page Tables (NPT) are enabled, preventing guest memory access and breaking mmu walk initialization. Red Hat and vendor advisories (RHSA-2...