CVE-2025-38142

The CVE-2025-38142 issue affects the Linux kernel hwmon path (asus-ec-sensors) where read_string() could read a non-existent sensor because find_ec_sensor_index() returned a negative value (for example -ENOENT) and was used without validation. The fix introduces a check to ensure sensor_index is ...

CVE-2025-38154

CVE-2025-38154 affects the Linux kernel sockmap path (bpf/sockmap) where sk->sk_socket can be used after free due to a race with backlog/thread close paths. The description in the connected documents explains that sk_socket is not locked/referenced in the backlog, enabling a race with the rele...

CVE-2025-38167

The CVE-2025-38167 entry pertains to the Linux kernel, specifically the ntfs3 filesystem driver. Root cause: hdr_first_de() may return NULL, and error handling for this return value should be implemented consistently. The description notes that error handling already exists at other call sites. I...

CVE-2025-38256

CVE-2025-38256 involves io_uring/rsrc folio unpinning in the Linux kernel. The issue arises when pinning a folio’s tail page and then unpinning the head page via unpin_user_page*, which can trigger a debug warning in mm/gup.c. The provided connected Astra Linux bulletin confirms the root cause an...

CVE-2025-38353

CVE-2025-38353: Linux kernel drm/xe wedge handling fix. Affected component: xe DRM path. Root cause: taking an invalid wedge lock when device wedges on GuC upload, leaving state uninitialized and submission not enabled. Impact: device wedged with recovery required; observed WARN/lock debugging ou...

CVE-2025-38406

CVE-2025-38406 affects the Linux kernel wifi driver ath6kl: the vulnerability originates from an unnecessary WARN_ON() when firmware input is bad. The description clarifies that bad firmware input is unrelated to the driver stack and does not constitute an exploitable condition; the fix instead p...

CVE-2025-38448

CVE-2025-38448 is a Linux kernel vulnerability in the USB gadget u_serial wakeup path. The issue is a race condition where gs_start_io() may call gs_start_rx() or gs_start_tx() after briefly dropping port_lock for usb_ep_queue(), allowing gs_close() or gserial_disconnect() to clear port.tty and p...

CVE-2025-38465

CVE-2025-38465 is a Linux kernel netlink vulnerability related to wraparounds in sk->sk_rmem_alloc. The issue arises from reading and updating sk_rmem_alloc with a pattern like if (atomic_read(&sk->sk_rmem_alloc) > sk->sk_rcvbuf) atomic_add(skb->truesize, &sk->sk_rmem_alloc);, w...

CVE-2025-38527

CVE-2025-38527 – Linux kernel SMB (CIFS) oplock_break UAF : A race during unmount can lead to use-after-free of cinode in cifs_oplock_break. The fix is to hold an extra reference to the superblock for the duration of the oplock-break operation, ensuring the superblock and inodes remain valid unti...

CVE-2026-23191

CVE-2026-23191 (Linux kernel — ALSA aloop) resolves a race in the aloop PCM trigger path that could cause a use-after-free when repeatedly opening/closing the tied stream. The vulnerability occurs because the trigger callback checks the PCM state and stops the tied substream outside the cable loc...

CVE-2003-0984

CVE-2003-0984 affects the Linux kernel RTC code: RTC routines in kernel 2.4.23 and earlier do not properly initialize their structures, which could leak kernel data to user space. Exploitation would require local access (per CVSS data), with partial impact on confidentiality, integrity, and avail...

CVE-2005-0001

CVE-2005-0001 describes a race condition in the Linux kernel page fault handler (fault.c) that affects multiprocessor systems. Affected kernel lines include 2.2.x to 2.2.7, 2.4 up to 2.4.29, and 2.6 up to 2.6.10. The vulnerability enables local attackers to execute arbitrary code by exploiting co...

CVE-2005-3272

CVE-2005-3272 affects the Linux kernel prior to 2.6.12. The issue lets remote attackers poison the bridge forwarding table with frames that have already been dropped by filtering, causing the bridge to forward spoofed packets. The vulnerability stems from how bridge/frame filtering handling inter...

CVE-2006-5751

CVE-2006-5751 concerns the Linux kernel (pre-2.6.18.4) where an integer overflow in get_fdb_entries (net/bridge/br_ioctl.c) allows a local user to trigger arbitrary code execution by supplying a large maxnum in an ioctl. The issue is rooted in kernel networking bridge ioctl handling and could ena...

CVE-2007-6762

The vulnerability is in the Linux kernel before 2.6.20, caused by an off-by-one error in net/netlabel/netlabel_cipso_v4.c that can overflow the doi_def->tags[] array. Affected component is the kernel’s netlabel CipSO v4 handling. The provided connected sources confirm the off-by-one overflow c...

CVE-2008-3525

Vulnerability (CVE-2008-3525) affects the Linux kernel 2.6.26.3 wan driver (sbni.c) where sbni_ioctl fails to perform CAP_NET_ADMIN checks before handling four ioctls (SIOCDEVRESINSTATS, SIOCDEVSHWSTATE, SIOCDEVENSLAVE, SIOCDEVEMANSIPATE). This permits a local user to bypass intended capability r...

CVE-2009-3638

CVE-2009-3638 affects the Linux kernel KVM subsystem: integer overflow in kvm_dev_ioctl_get_supported_cpuid (arch/x86/kvm/x86.c) allows local users to trigger an unspecified impact via KVM_GET_SUPPORTED_CPUID requests. Affected versions are Linux kernels before 2.6.31.4. Remediation is to upgrade...

CVE-2009-3725

CVE-2009-3725 affects the Linux kernel prior to 2.6.31.5 and relates to the connector layer not requiring CAP_SYS_ADMIN for certain interactions with uvesafb, pohmelfs, dst, or dm, enabling local users to bypass access restrictions and escalate privileges. Public references corroborate a local-pr...

CVE-2010-4563

The Connected documents provide concrete detail for CVE-2010-4563: when the Linux kernel handles IPv6, an attacker can probe for sniffing by sending an ICMPv6 Echo Request to a multicast address and observing whether an Echo Reply is returned (as shown by thcping). This affects the Linux kernel’s...

CVE-2011-0699

The CVE-2011-0699 entry affects the Linux kernel 2.6.37, where an integer signedness error in the btrfs_ioctl_space_info function can allow a local user to trigger a denial of service via a heap-based buffer overflow or potentially other impact through a crafted slot value. Affected component: ke...

CVE-2011-1768

The CVE-2011-1768 entry affects the Linux kernel, specifically the tunnels implementation. It states that when tunnel functionality is compiled as a module (pre-2.6.34), a remote attacker can trigger a denial of service (OOPS) by sending a packet during module loading. This is tied to the kernel’...

CVE-2011-2928

CVE-2011-2928 affects the Linux kernel prior to 3.1-rc3, specifically the befs_follow_link function in fs/befs/linuxvfs.c. The flaw does not validate the length attribute of long symlinks on a malformed Be filesystem, enabling a local attacker to trigger an incorrect pointer dereference and OOPS,...

CVE-2012-0028

CVE-2012-0028 affects the Linux kernel’s futex implementation prior to version 2.6.28. The root cause is that processes executing an exec can write to memory in a child process due to improper futex handling, potentially allowing local users to cause a denial of service or to gain privileges. The...

CVE-2012-2383

CVE-2012-2383 affects the Linux kernel DRM/i915 component: an integer overflow in i915_gem_execbuffer2() within drivers/gpu/drm/i915/i915_gem_execbuffer.c. On 32-bit platforms and prior to kernel 3.3.5, this allows a local user to trigger an out-of-bounds write via a crafted ioctl, leading to a p...

CVE-2012-5517

CVE-2012-5517 is referenced in multiple advisories. The connected documents confirm a vulnerability in the Linux kernel before 3.6 where the online_pages function in mm/memory_hotplug.c can be abused by local users to cause a denial of service via a NULL pointer dereference when memory hot-added ...

CVE-2013-0310

The issue CVE-2013-0310 affects the Linux kernel, specifically the cipso_v4_validate function in net/ipv4/cipso_ipv4.c. In kernels prior to 3.4.8, local attackers can trigger a NULL pointer dereference and system crash via IPOPT_CIPSO IP_OPTIONS used with setsockopt, enabling potential local deni...

CVE-2013-2128

The CVE-2013-2128 issue affects the Linux kernel’s tcp_read_sock() in net/ipv4/tcp.c where skb consumption is not properly managed. This can allow local attackers to trigger a denial of service (system crash) by issuing a crafted splice() on a TCP socket. Evidence appears across multiple advisori...

CVE-2016-4440

The CVE-2016-4440 issue affects the Linux kernel (up to 4.6.3) in arch/x86/kvm/vmx.c where APICv on/off state is mishandled. This allows guest OS users to access direct host APIC MSRs via x2APIC, enabling potential host denial of service (crash) or arbitrary code execution. A fix exists in the up...

CVE-2016-9919

The CVE-2016-9919 entry concerns the Linux kernel y icmp6_send in net/ipv6/icmp.c, vulnerable through kernel version 4.8.12. The flaw omits a check of the dst data structure, allowing remote attackers to trigger a denial of service (panic) by sending a fragmented IPv6 packet. Connected advisories...

CVE-2017-15306

The CVE-2017-15306 entry concerns the Linux kernel (PowerPC) KVM. The vulnerable component is arch/powerpc/kvm/powerpc.c, specifically the kvm_vm_ioctl_check_extension function. The issue arises when handling the KVM_CHECK_EXTENSION KVM_CAP_PPC_HTM ioctl on /dev/kvm, allowing a local attacker to ...

CVE-2018-5873

The CVE-2018-5873 entry refers to a race-condition induced Use-After-Free in the Linux kernel before 4.11, specifically in __ns_get_path within fs/nsfs.c. This affects the mainline Linux kernel and Android builds derived from CAF for Android kernels (Android for MSM, Firefox OS for MSM, QRD Andro...

CVE-2021-47102

CVE-2021-47102 pertains to the Linux kernel marvell prestera code. The issue is a faulty structure access in prestera: upper = info->upper_dev; this field is only valid for specific notifiers (e.g., NETDEV_CHANGEUPPER). For other events, this can read info->upper_dev beyond its valid contex...

CVE-2021-47200

CVE-2021-47200 is a Linux kernel security issue affecting DRM/GEM objects during mmap via drm_gem_ttm_mmap. The root cause is dropping a gem object's reference on success and subsequently dereferencing after a potential use-after-free if the object’s refcount was 1 on entry to drm_gem_prime_mmap(...

CVE-2021-47206

CVE-2021-47206 is a Linux kernel vulnerability in the usb: host: ohci-tmio path. The root cause is a missing check of the return value from platform_get_resource(), which can lead to a NULL pointer dereference and a potential crash (availability impact). The vulnerability is resolved in the kerne...

CVE-2021-47241

The CVE-2021-47241 issue is a Linux kernel vulnerability related to ethtool: strset: fix message length calculation. The root cause is that the outer nest for ETHTOOL_A_STRSET_STRINGSETS was not accounted for, which could cause ETHTOOL_MSG_STRSET_GET to emit a warning and potentially trigger a sp...

CVE-2021-47334

CVE-2021-47334 affects the Linux kernel’s misc/libmasm/module in the ibmasm_init_one path. The issue is two use-after-free defects arising from ibmasm_init_one/ibmasm_init_remote_input_dev: mouse_dev and keybd_dev allocated by input_allocate_device() are freed in err_free_devices, then ibmasm_fre...

CVE-2021-47390

CVE-2021-47390 concerns the Linux kernel KVM path on x86, where KASAN reports a stack-out-of-bounds access in kvm_make_vcpus_request_mask() when handling IOAPIC indirect requests. The root cause is that the vcpu_bitmap is allocated as a single stack long instead of a size equal to KVM_MAX_VCPUS, ...

CVE-2021-47413

CVE-2021-47413 concerns a NULL pointer dereference in the Linux kernel (usb: chipidea: ci_hdrc_imx) when a 'phys' phandle is provided in devicetree on i.MX7/i.MX8MM. The chipidea core populates usb_phy in ci_hdrc, while charger logic checks data->usb_phy in imx_usbmisc_data, causing a NULL der...

CVE-2021-47467

CVE-2021-47467: In the Linux kernel, a reference-count leak occurs in the kunit path of kfree_at_end when kunit_alloc_and_get_resource() is invoked. The resource’s refcount is increased but not properly accounted for, leaking a reference in the normal path. The fix replaces kunit_alloc_and_get_re...

CVE-2021-47535

CVE-2021-47535 refers to a Linux kernel flaw in drm/msm/a6xx where a6xx_get_gmu_registers() now reads 3 GMU register sets but the destination array was not resized, causing a slab-out-of-bounds write (KASAN) on affected ChromeOS 5.4 kernels. The issue can trigger memory corruption during crashsta...

CVE-2021-47586

The CVE-2021-47586 entry relates to the Linux kernel net: stmmac: dwmac-rk driver. KASAN reported an out-of-bounds read in rk_gmac_setup due to iterating over a flexible array member (regs) with a loop (while (ops->regs[i]) that reads past the ops structure on platforms where the array is empt...

CVE-2021-47603

In CVE-2021-47603, the Linux kernel audit subsystem is affected: kauditd_thread() could block when sending audit records if the audit daemon is stopped, allowing the audit backlog to grow beyond limits and potentially cause a deadlock. The referenced patch lowers the kernel thread’s socket send t...

CVE-2022-2785

CVE-2022-2785 affects the Linux kernel BPF subsystem. The vulnerability arises because constants used to fill pointers in structs passed to bpf_sys_bpf are not verified, allowing an attacker with CAP_BPF to read memory anywhere on the system. Affected systems can face arbitrary memory reads, with...

CVE-2022-48650

CVE-2022-48650 : In the Linux kernel, memory leak in the SCSI qla2xxx path (__qlt_24xx_handle_abts()) occurs when tcm_qla2xxx_find_cmd_by_tag() doesn’t find a command and the command’s memory isn’t freed after an early return. The issue was fixed by commit 8f394da36a36, which also dropped TARGET_...

CVE-2022-48740

CVE-2022-48740 refers to a Linux kernel vulnerability where on error paths from cond_read_list() and duplicate_policydb_cond_list(), cond_list_destroy() could be called twice, causing a NULL pointer dereference. The fix zeroes cond_list_len in cond_list_destroy() and sets cond_list to NULL after ...

CVE-2022-48755

The CVE-2022-48755 issue is a Linux kernel vulnerability affecting powerpc64 systems where BPF code could emit ldbrx instructions not supported on processors older than ISA v2.06. The root cause is an ISA compatibility gap in the ldbrx path used by BPF_FROM_[L|E] and BPF_FROM_[L|B]E, leading to a...

CVE-2022-48847

CVE-2022-48847 concerns the Linux kernel: a fix for watch_queue_set_filter() where a type check used BITS_PER_LONG could overflow the type_filter bitmap, enabling out-of-bounds writes to wfilter->type_filter and to wfilter->filters[]. The issue arises from two separate checks; one uses 8* s...

CVE-2022-48849

CVE-2022-48849 affects the Linux kernel (drm/amdgpu) where tiling flag checks were bypassed in the virtual display path. The issue arises in framebuffer initialization when VKMS virtual display is enabled and VKMS does not support FB modifiers, potentially allowing a local attacker to bypass expe...

CVE-2022-48851

CVE-2022-48851 is a Linux kernel issue in the staging: gdm724x driver. The root cause is a use-after-free in gdm_lte_rx(), where netif_rx_ni() frees the skb, making it unsafe to dereference to read skb->len. The connected sources confirm the vulnerability and its resolution in the kernel, with...

CVE-2022-48855

CVE-2022-48855: The connected advisories confirm a Linux kernel SCTP kernel-infoleak fix. The issue arose because r->idiag_expires was not initialized when inet_sctp_diag_fill() invoked inet_diag_msg_common_fill(), enabling a potential 4-byte kernel infoleak via SCTP sockets. The fix requires ...