CVE-2025-38044

CVE-2025-38044 affects the Linux kernel cx231xx media subsystem. The video_device for the MPEG encoder did not set device_caps, preventing registration and causing a WARN_ON. The fix adds device_caps for the 417 decoder path so the video device can register normally. This addresses a local-priori...

CVE-2025-38126

CVE-2025-38126 affects the Linux kernel’s stmmac driver in timestamp configuration. The root cause is that clk_ptp_rate can become 0 (if clk_get_rate returns 0 and the driver does not override it), leading to a division by zero during PTP initialization. The issue is fixed by adding an explicit c...

CVE-2025-38143

CVE-2025-38143 (Linux kernel) is addressed in Azure Linux 3.0 by a patch that fixes a NULL-dereference in backlight pm8941 when devm_kasprintf() returns NULL. The issue occurs in wled_configure() due to a missing NULL check after allocation. The fix adds the necessary NULL check after devm_kaspri...

CVE-2025-38166

CVE-2025-38166: In the Linux kernel, the bpf ktls panic with sockmap was fixed. The issue arises when a BPF program adds data to a message (e.g., via bpf_msg_push_data) increasing msg_pl->sg.size after a cork scenario, which can trigger a rollback path that assumes a consistent msg_iter size. ...

CVE-2025-38214

CVE-2025-38214 affects the Linux kernel fbdev path. The issue arises when fb_add_videomode() in fb_set_var() fails to allocate fb_videomode, potentially causing a null pointer dereference in fb_videomode_to_var() because fb_info->var is modified before modelist validation. The debug trace show...

CVE-2025-38246

CVE-2025-38246 affects the bnxt Ethernet driver in the Linux kernel. The vulnerability stems from an incorrect handling of XDP redirect lists that could corrupt a linked list (list_add) and trigger a crash when XDP_REDIRECT is used, as described in the initial CVE note and echoed in connected adv...

CVE-2025-38251

CVE-2025-38251 refers to a NULL-dereference in the Linux kernel ATM clip subsystem (clip_push) when clip_devs is NULL, caused by vcc_destroy_socket() calling clip_push() with a NULL skb. The vulnerability is fixed by upstream commits cited in the CVE entry and is reflected in multiple advisories ...

CVE-2025-38285

CVE-2025-38285 – Linux kernel : The issue stems from a WARN_ON_ONCE in the BPF tracing path (get_bpf_raw_tp_regs) triggered by a corner case involving trace_mmap_lock and stack maps. The issue surfaces during BPF stack retrieval and is reported in kernel/bpf_trace.c, with inline calls in bpf_get_...

CVE-2025-38290

CVE-2025-38290 (Azure Linux 3.0 kernel) : A WLAN recovery race in ath12k caused possible kernel panic due to node corruption in arvifs during vif removal. The fix reinitializes all arvifs list nodes when WLAN halts, preventing list_del() from operating on an invalid node. Affected platform is the...

CVE-2025-38304

CVE-2025-38304 : In the Linux kernel, a NULL pointer dereference in Bluetooth eir_get_service_data (len parameter can be NULL) is fixed. The vulnerability affects the Bluetooth EIR handling path and is rated with LOCAL attack vector and HIGH availability impact, implying potential kernel crash or...

CVE-2025-38307

CVE-2025-38307 refers to a Linux kernel vulnerability in the ASoC: Intel: avs driver. The issue arises from how parse_int_array() returns content: the first element stores the array length, and if that length is 0, manipulating beyond index 0 can cause a null-ptr-deref. The vulnerability is trigg...

CVE-2025-38344

CVE-2025-38344 relates to ACPICA in the Linux kernel where ACPI cache leaks were fixed. Technical details in connected docs show memory leaks in Acpi-State, Acpi-Parse, and Acpi-parse_ext caches due to merging of slabs and use of KMEM cache flags (SLAB_NEVER_MERGE). The root cause was leaks in ea...

CVE-2025-38376

CVE-2025-38376 concerns the Linux kernel USB gadget: udc suspend/resume hang when the host continues data transfer while the bus is active and the controller is gated off. The root cause is that the USB device controller is suspended but the USB bus remains active, causing pending USB requests an...

CVE-2025-38436

CVE-2025-38436 affects the Linux kernel’s DRM Scheduler. The issue occurs when killing an entity from application B: drm_sched_entity_kill() removes all jobs for that entity via drm_sched_entity_kill_jobs_work(), but if application A’s job depends on a scheduled fence from application B’s job, th...

CVE-2025-38444

CVE-2025-38444 affects the Linux kernel raid10 path. When raid10_read_request or raid10_write_request registers a new request with REQ_NOWAIT, a malloc from the mempool may not be freed, causing a memory leak. Connected docs confirm concrete fix in raid10_make_request and related raid10 handling ...

CVE-2025-38458

The CVE-2025-38458 entry concerns the Linux kernel vulnerability in atm/clip: a NULL pointer dereference in vcc_sendmsg(), which can lead to a kernel crash (OOPS) when atmarpd_dev_ops does not implement the send method. The provided trace shows a NULL address dereference and a call path through v...

CVE-2025-38470

CVE-2025-38470 affects the Linux kernel VLAN handling when 8021q rx-vlan-filter is enabled. It can cause VLAN 0 to be emulated on NETDEV_UP/DC_DOWN, leading to a memory leak if VLAN 0 is not removed, or a potential null-vlan_info path triggering a BUG_ON during device teardown. Root cause: refcnt...

CVE-2025-38473

CVE-2025-38473 affects the Linux kernel Bluetooth subsystem. A null-ptr-deref in l2cap_sock_resume_cb() can occur when handling l2cap sockets during resume/kill sequences. The fix adds a guard to ensure chan->data is not NULL, avoiding use-after-free/killed-socket access. The description refer...

CVE-2025-38493

CVE-2025-38493 concerns the Linux kernel vulnerability in tracing/osnoise, specifically timerlat_dump_stack(). The root cause is a faulty memcpy that uses a size field containing garbage from the ring buffer, which can trigger a buffer overflow and kernel panic when stack data is dumped. The vuln...

CVE-2026-22992

Mode C: The CVE-2026-22992 issue affects the Linux kernel’s libceph stack. Root cause: mon_handle_auth_done() no longer propagates errors from ceph_auth_handle_reply_done(), so a failure during authentication could be misinterpreted by higher layers while msgr2 proceeds with session setup. Potent...

CVE-2026-23243

CVE-2026-23243 is a Linux kernel vulnerability involving RDMA/umad_write, where user-controlled MAD header size mismatch could yield a negative data_len, leading to an out-of-bounds memset in alloc_send_rmpp_list. The issue has a concrete upstream fix that rejects negative data_len before creatin...

CVE-2026-23455

TL;DR : CVE-2026-23455 is a Linux kernel vulnerability in netfilter nf_conntrack_h323, fixed by adding a check so the decoded length remains positive after subtracting the protocol discriminator. Affected component : Linux kernel, nf_conntrack_h323 DecodeQ931() UserUserIE path. Root cause : The d...

CVE-2026-46259

In the Linux kernel procfs path do_task_stat() reading /proc/[pid]/stat, task->real_parent is accessed without proper RCU protection, enabling a potential Use-After-Free when another task is released. The fix switches from task_tgid_nr_ns() to task_ppid_nr_ns() to add proper RCU protection for...

CVE-2026-46321

Summary. CVE-2026-46321 concerns the Linux kernel tun/tap with vhost-net, where a short-frame rejection path in tun_xdp_one() can leak memory pages. Specifically, when a frame is shorter than ETH_HLEN, tun_xdp_one() returns -EINVAL without freeing the page allocated by vhost_net_build_xdp(). tun_...

CVE-2005-0815

CVE-2005-0815 affects the Linux kernel iso9660 filesystem handler in versions up to 2.6.11 (and earlier). The issue is described as multiple range-checking flaws in the ISO-9660 file system code, which could be triggered by mounting a crafted/corrupted ISO image on CD-ROM. Impact stated in connec...

CVE-2005-0867

CVE-2005-0867 involves an integer overflow in the Linux kernel 2.6 sysfs_write_file() function. The Ubuntu USN-110-1 and Red Hat RHSA-2005:366 describe a local user could exploit this to crash the kernel or possibly execute code with root privileges by writing to a user-writable sysfs file under ...

CVE-2006-3745

CVE-2006-3745 affects the SCTP implementation in Linux 2.6.x (before 2.6.17.10) and 2.4.x (up to 2.4.33). The vulnerability resides in sctp_make_abort_user and allows a local user to cause a denial of service (panic) and potentially gain root privileges via unspecified attack vectors. Connected s...

CVE-2006-4814

CVE-2006-4814 is a mincore-related Linux kernel vulnerability restricted to older kernels (before 2.4.33.6) where access to user space was not properly locked, potentially causing a system hang (deadlock). Public sources in connected advisories confirm this CVE as part of multiple kernel updates,...

CVE-2007-3740

CVE-2007-3740 describes a flaw in the CIFS filesystem of the Linux kernel prior to 2.6.22 where Unix extension support can fail to honor the process umask, enabling a local user to gain privileges. Affected are kernels with CIFS Unix extensions enabled; impact is local privilege escalation. Remed...

CVE-2009-0859

CVE-2009-0859 affects the Linux kernel shm subsystem (ipc/shm.c). When CONFIG_SHMEM is disabled, shm_get_stat misinterprets the inode data type, enabling local users to trigger a denial of service (system hang) via an SHM_INFO shmctl call (as demonstrated by the ipcs program). The advisory notes ...

CVE-2009-1242

CVE-2009-1242: In the Linux kernel, the vmx_set_msr function of the KVM VMX implementation (arch/x86/kvm/vmx.c) on i386 allowed a local guest OS user to trigger a denial of service (OOPS) by setting the EFER_LME bit in the EFER MSR. The issue affects kernel versions before 2.6.29.1 and is tied to...

CVE-2010-0003

The connected document confirms CVE-2010-0003 affects the Linux kernel (i386) before 2.6.32.4, where the print_fatal_signal path in kernel/signal.c can let local users read arbitrary memory by jumping to an address and reading a log, with potential DoS via the same jump. This is associated with t...

CVE-2010-0291

CVE-2010-0291 is a Linux kernel local privilege/escalation/DoS issue described in connected advisories as affecting the kernel before 2.6.32.4. The vulnerability stems from the do_mremap/mmap handling, allowing local users to gain privileges or trigger a panic. The MiracleLinux AXSA:2010-377:12 a...

CVE-2010-2946

CVE-2010-2946 affects the Linux kernel via a flaw in fs/jfs/xattr.c where a legacy extended-attributes storage format could let local attackers bypass xattr namespace restrictions using an os2. prefix. Several connected advisories confirm the issue and reference the affected range: Linux kernel v...

CVE-2010-4074

CVE-2010-4074 affects Linux kernel USB subsystem prior to 2.6.36-rc5, where several structure members were not properly initialized. This can let local users read potentially sensitive data from kernel stack memory via TIOCGICOUNT-related ioctl paths, specifically mos7720_ioctl and mos7840_ioctl ...

CVE-2011-0006

CVE-2011-0006 affects the Linux kernel before 2.6.37: the ima_lsm_rule_init function in security/ima/ima_policy.c allows a local user to bypass IMA rules if LSM is disabled by an administrator's added IMA rule for LSM. Root cause is a bug in ima_policy.c. The advisory notes this as a fix in 2.6.3...

CVE-2011-1173

CVE-2011-1173 affects the Linux kernel on x86_64 prior to 2.6.39. The vulnerability is in the econet_sendmsg function (net/econet/af_econet.c) and allows a remote attacker to read uninitialized data from kernel stack memory via an Acorn Universal Networking (AUN) packet, enabling information disc...

CVE-2011-2898

CVE-2011-2898 concerns the Linux kernel AF_PACKET implementation. The flaw allows local users to read potentially sensitive kernel memory by exploiting inadequate restrictions on VLAN Tag Control Information data structures. The vulnerability is described as a kernel information leak in the AF_PA...

CVE-2013-1797

CVE-2013-1797 describes a use-after-free in arch/x86/kvm/x86.c of the Linux kernel up to version 3.8.4. The issue allows a guest OS user to trigger a GPA-related path during an MSR_KVM_SYSTEM_TIME kvm_set_msr_common operation, potentially causing host memory corruption and a denial of service, wi...

CVE-2013-2895

CVE-2013-2895 affects the Linux kernel HID Logitech DJ driver (drivers/hid/hid-logitech-dj.c) up to version 3.11 when CONFIG_HID_LOGITECH_DJ is enabled. The vulnerability allows physically proximate attackers to cause a denial of service via a NULL pointer dereference and OOPS, or to read sensiti...

CVE-2014-7843

The CVE-2014-7843 entry affects the Linux kernel on ARM64 and is caused by the __clear_user function in arch/arm64/lib/clear_user.S. It allows local attackers to trigger a denial of service (system crash) by reading one byte beyond a /dev/zero page boundary in kernels prior to 3.17.4. Public refe...

CVE-2014-9870

The CVE-2014-9870 entry concerns the Linux kernel prior to 3.11 on ARM, including Android devices (Nexus 5/7) before 2016-08-05. It exposes a privilege-escalation path via improper handling of user-space access to the TPIDRURW register, enabling local attackers to gain privileges with a crafted a...

CVE-2014-9892

The CVE-2014-9892 issue affects the Linux kernel (up to 4.7) in the snd_compr_tstamp path used by Android on Nexus 5/7 devices. Root cause: snd_compr_tstamp does not initialize a timestamp data structure, enabling a crafted app to obtain sensitive information. Impact: information disclosure possi...

CVE-2014-9914

Summary of CVE-2014-9914 (Linux kernel) : A race condition in ip4_datagram_release_cb within net/ipv4/datagram.c (kernel before 3.15.2) can be exploited by a local user to gain privileges or cause a denial of service (use-after-free) due to incorrect locking assumptions during multithreaded IPv4 ...

CVE-2015-5327

CVE-2015-5327 affects the Linux kernel (4.3-rc1 and later); the flaw is an out-of-bounds memory read in x509_decode_time within x509_cert_parser.c. Impact is partially confidentiality (per CVSS2) and high confidentiality (per CVSS3); the issue is fixed by kernel patches (as noted in referenced ad...

CVE-2016-10150

CVE-2016-10150 is a use-after-free in kvm_ioctl_create_device (virt/kvm/kvm_main.c) of the Linux kernel before 4.8.13, allowing a local host user to crash the host or possibly gain privileges via crafted ioctl calls on /dev/kvm. The fix is provided in kernel version 4.8.13 and later; remediation ...

CVE-2016-2062

The CVE-2016-2062 issue affects the Adreno GPU driver for the Linux kernel (3.x) as used in Qualcomm QuIC MSM Android contributions. The root cause is an incorrect integer data type in adreno_perfcounter_query_group within drivers/gpu/msm/adreno_perfcounter.c, which can lead to a denial of servic...

CVE-2016-5340

CVE-2016-5340 is tied to a vulnerability in the KGSL Linux Graphics Module exposed by a QuIC Android patch for Linux kernel 3.x. The issue arises from the function is_ashmem_file in drivers/staging/android/ashmem.c, where pointer validation is mishandled. This design flaw can allow an attacker to...

CVE-2018-17977

CVE-2018-17977 affects Linux kernel 4.14.67, where interaction between XFRM Netlink messages, IPPROTO_AH, and IPPROTO_IP can be exploited locally (with root) to trigger memory exhaustion and system hang; demonstrated on CentOS 7. The provided documents do not specify a fix or patch version.

CVE-2021-47173

CVE-2021-47173 is a Linux kernel issue described in connected advisories as a memory-leak bug in the USB subsystem. Specifically, the probe for the uss720 device (uss720_probe) forgets to decrement the usbdev refcount, leading to a memory leak. The fix recorded in the sources is to release the de...