CVE-2024-41003

The CVE-2024-41003 entry concerns a Linux kernel BPF verifier bug: after a prior OR, line 19 triggers a REG INVARIANTS VIOLATION due to a corrupted fake_reg when reg_set_min_max is applied to a known-constant branch. The issue arises in the BPF subsystem’s handling of register invariants during a...

CVE-2024-41021

CVE-2024-41021: Linux kernel (s390) fixes VM_FAULT_HWPOISON handling in do_exception. The s390 arch has no HWPOISON/MEMORY_FAILURE/ARCH_HAS_COPY_MC, so HWPOISON was not expected here; fix makes HWPOISON behave like VM_FAULT_SIGBUS (as for MEMORY_FAILURE on x86) and adds printing of unexpected fau...

CVE-2024-41025

In the connected documents, CVE-2024-41025 is described as a Linux kernel issue fixed by addressing a memory leak in the fastrpc audio daemon attach path. Specifically, the Audio PD daemon copies a name via init IOCTL into kernel memory that is allocated but not freed, causing a leak. The vulnera...

CVE-2024-43875

CVE-2024-43875 affects the Linux kernel PCI endpoint code, specifically vpci_scan_bus in drivers/pci/endpoint/functions/pci-epf-vntb.c. The issue is improper NULL checking and error handling: Smatch reported that vpci_bus could be NULL, leading to an error path that would crash instead of returni...

CVE-2024-56547

In CVE-2024-56547, the Linux kernel’s RCU no-coalescing (nocb) path has a missed barrier on deoffloading, which can trigger a WARN and, in certain racing scenarios, deadlock when rcu_barrier() is invoked on offline CPUs. The vulnerability arises during offline/offloading interactions where multip...

CVE-2024-57941

CVE-2024-57941 concerns the Linux kernel netfs cache handling. When the cache is temporarily disabled, netfs_advance_write() may bail out without subrequests, leaving folios with PG_private_2 and discarding the request. The root cause is the use of the deprecated PG_private_2 path by netfslib (e....

CVE-2024-57943

CVE-2024-57943 affects the Linux kernel exFAT path where a newly allocated buffer head could write uninitialized data from the page cache. The root cause is that buffers marked as new were not zeroed before write_end(), risking data leakage or corruption. The remediation is a kernel commit that c...

CVE-2025-21789

CVE-2025-21789 concerns the Linux kernel IP checksum code. The issue arises from the LoongArch path where commit 69e3a6aa6be2 introduced a negative-length OoB access/undefined shift in the IP checksum, which could trigger an out-of-bounds read under certain conditions. A corresponding ARM64 fix w...

CVE-2025-21798

CVE-2025-21798 concerns the Linux kernel FireWire kunit test. The vulnerability arises when kunit_kzalloc() returns NULL and test_state is dereferenced without a NULL check, potentially causing a NULL pointer dereference. A fix adds a NULL check for test_state to prevent dereferencing a NULL poin...

CVE-2025-21907

CVE-2025-21907 documents a Linux kernel memory-management issue: during folio migration, unmap_poisoned_folio() must set TTU_HWPOISON for anon folio (and align policy with hwpoison_user_mappings for pagecache). The patch series mm: memory_failure: unmap poisoned folio during migrate properly fixe...

CVE-2025-37888

Technical details for CVE-2025-37888 are not provided in the supplied documents; only a high-level description of the Linux kernel fix is shown. Please monitor for vendor advisories for affected products and remediation.

CVE-2025-37919

CVE-2025-37919 affects the Linux kernel (AMD SoC ASoC/ACPi2S) via a NULL pointer dereference in the function acp_i2s_set_tdm_slot . The root cause is dereferencing a NULL chip data reference when updating ACPI/I2S state. The remediation, as stated in the description, is to update chip data using ...

CVE-2025-37950

CVE-2025-37950 concerns the Linux kernel, specifically the ocfs2 subsystem. The issue arises when the folio array allocation fails (ENOMEM) during an update that converts w_pages to w_folios, and the free-path code expects valid folio pointers or NULLs. If -ENOMEM is encountered, a panic can occu...

CVE-2025-38023

CVE-2025-38023 affects the Linux kernel: if nfs_get_lock_context() fails due to ENOMEM, a stored -ENOMEM in an nfs4_unlockdata could be treated as valid and lead to a NULL pointer dereference in nfs4_locku_prepare via rpc_run_task. The fix ensures nfs4_unlockdata is freed when allocation fails an...

CVE-2025-38105

CVE-2025-38105 concerns the Linux kernel ALSA USB audio path. The issue arises when the USB-audio MIDI driver’s timer is initialized but the driver is freed without an explicit disconnect, potentially leaving an active timer and triggering a kernel warning under debug builds. The documented fix i...

CVE-2025-38122

In CVE-2025-38122, the Linux kernel vulnerability is due to a missing NULL check in gve_alloc_pending_packet() used by gve_tx_add_skb_dqo(). The function can return NULL, but the caller did not guard against this, risking NULL pointer dereference in low‑memory scenarios. The fix adds the missing ...

CVE-2025-38135

CVE-2025-38135 – Linux kernel (serial/mlb_usio_probe) NULL pointer dereference fix : The vulnerability arises when devm_ioremap() returns NULL on error and mlb_usio_probe() fails to check it, potentially leading to a NULL pointer dereference. The fix adds a NULL check after devm_ioremap() to prev...

CVE-2025-38151

Technical details about CVE-2025-38151 are not publicly provided in the supplied documents; no explicit information on affected kernel versions, root cause, impact, or patch is included. Monitor for updates.

CVE-2025-38167

The CVE-2025-38167 entry pertains to the Linux kernel, specifically the ntfs3 filesystem driver. Root cause: hdr_first_de() may return NULL, and error handling for this return value should be implemented consistently. The description notes that error handling already exists at other call sites. I...

CVE-2025-38182

CVE-2025-38182 affects the Linux kernel ublk (userspace block driver). The connected advisories confirm the issue is fixed in the kernel by sanitizing arguments from userspace when adding a device and by sanity-checking the queue depth/number of queues obtained from userspace. Root cause: inadequ...

CVE-2025-38194

CVE-2025-38194 affects the Linux kernel’s JFFS2 file system. The issue arises when jffs2_sum_write_sumnode does not validate the return value of jffs2_prealloc_raw_node_refs, allowing an preallocation error to propagate into jffs2_link_node_ref and potentially cause a kernel BUG at fs/jffs2/nodel...

CVE-2025-38214

CVE-2025-38214 affects the Linux kernel fbdev path. The issue arises when fb_add_videomode() in fb_set_var() fails to allocate fb_videomode, potentially causing a null pointer dereference in fb_videomode_to_var() because fb_info->var is modified before modelist validation. The debug trace show...

CVE-2025-38225

CVE-2025-38225 is a Linux kernel issue affecting the media: imx-jpeg driver, where failures to clean up after an allocation error can cause buffers to remain uninitialized and lead to NULL pointer dereferences. The vulnerability is resolved in upstream kernel fixes, with Debian and other vendors ...

CVE-2025-38315

CVE-2025-38315 concerns a Linux kernel Bluetooth driver issue (btintel). The root cause is a mismatch between the EFI variable size and the known struct btintel_dsbr size, which could lead to a stack overflow if the EFI variable is larger than expected. The fix alters the check to rely on the kno...

CVE-2025-38335

CVE-2025-38335 concerns a Linux kernel vulnerability in the gpio_keys driver related to PREEMPT_RT. The description states that when PREEMPT_RT is enabled, gpio_keys_irq_timer() can run in hard IRQ context while input_event() uses a spin_lock, which is incompatible with hard IRQ. This leads to a ...

CVE-2025-38426

Technical details about CVE-2025-38426 are not provided in the supplied documents. Open items reference the issue at a high level; monitor for updates from the OSV/OpenVAS/Tenable sources for concrete affected components, root cause, and fixes.

CVE-2025-38427

Summary: CVE-2025-38427 in the Linux kernel fixes a framebuffer relocation bug where screen_info frames were tied to boot CPU addresses, not accounting for PCI host-bridge offsets. During boot, firmware may assign a different PCI memory offset, relocating PCI graphics framebuffer addresses. The k...

CVE-2025-38448

CVE-2025-38448 is a Linux kernel vulnerability in the USB gadget u_serial wakeup path. The issue is a race condition where gs_start_io() may call gs_start_rx() or gs_start_tx() after briefly dropping port_lock for usb_ep_queue(), allowing gs_close() or gserial_disconnect() to clear port.tty and p...

CVE-2025-38502

Technical details beyond the initial description are not provided in the connected documents; no explicit product/version, impact specifics, or remediation are present here. Monitor for updates.

CVE-2026-23247

CVE-2026-23247 is a Linux kernel TCP/TCP options issue that reintroduces port inclusion in the TS offset to mitigate an off-path TCP source port leakage via a SYN-cookie side-channel. The vulnerability is resolved by reverting a previous downgrade of timestamp offsets and performing a single siph...

CVE-2026-31682

CVE-2026-31682 affects the Linux kernel bridge implementation, where br_nd_send may parse non-linear ND options from ns->opt[]. The root cause is failure to linearize the skb before ND option parsing, risking reads past the buffer and potential memory exposure or crash. The fix is to linearize...

CVE-2026-46155

CVE-2026-46155 affects the Linux kernel SMB client. The vulnerability is an out-of-bounds read in smb2_compound_op() caused by memcpy reading size[0] (OutputBufferLength) when iov_len is smaller than that length after a truncated server response. This can leak adjacent kernel heap memory. Impact ...

CVE-2026-53399

The CVE-2026-53399 issue affects the Linux kernel NFS server (nfsd) where nfs4_alloc_stid() publishes a new stid into cl_stateids with idr_alloc_cyclic under cl_lock, and if nfsd4_layout_setlease() fails, the teardown path frees the layout stateid directly via kmem_cache_free() without idr_remove...

CVE-2026-63795

CVE-2026-63795 affects the Linux kernel 9p client implementation. The issue occurs when p9_client_walk() is called with clone=false and the fid aliases oldfid; if the walk fails after a request is sent, the error path may clunk the fid and destroy oldfid even when the caller still owns it, causin...

CVE-2005-0001

CVE-2005-0001 describes a race condition in the Linux kernel page fault handler (fault.c) that affects multiprocessor systems. Affected kernel lines include 2.2.x to 2.2.7, 2.4 up to 2.4.29, and 2.6 up to 2.6.10. The vulnerability enables local attackers to execute arbitrary code by exploiting co...

CVE-2005-0867

CVE-2005-0867 involves an integer overflow in the Linux kernel 2.6 sysfs_write_file() function. The Ubuntu USN-110-1 and Red Hat RHSA-2005:366 describe a local user could exploit this to crash the kernel or possibly execute code with root privileges by writing to a user-writable sysfs file under ...

CVE-2006-4145

CVE-2006-4145 affects the Linux kernel UDF filesystem driver (2.6.17 and earlier). The issue allows a local user to trigger a hang or crash by performing operations on truncated files (illustrated via dd). Public documents in connected feeds confirm this CVE and indicate that updated kernel packa...

CVE-2007-6151

CVE-2007-6151 affects the Linux kernel ISDN subsystem (ISDN ioctl path). The description in the Initial document states a local user can trigger a denial-of-service via a crafted ioctl struct where iocts is not null-terminated, causing a buffer overflow in isdn_common.c. Connected documents (RHSA...

CVE-2008-4554

CVE-2008-4554 affects the Linux kernel in the do_splice_from function (fs/splice.c). Before 2.6.27, it does not reject file descriptors with the O_APPEND flag, allowing a local attacker to bypass append mode and make arbitrary changes to other parts of a file. The vulnerability is tied to the ker...

CVE-2009-0859

CVE-2009-0859 affects the Linux kernel shm subsystem (ipc/shm.c). When CONFIG_SHMEM is disabled, shm_get_stat misinterprets the inode data type, enabling local users to trigger a denial of service (system hang) via an SHM_INFO shmctl call (as demonstrated by the ipcs program). The advisory notes ...

CVE-2009-1242

CVE-2009-1242: In the Linux kernel, the vmx_set_msr function of the KVM VMX implementation (arch/x86/kvm/vmx.c) on i386 allowed a local guest OS user to trigger a denial of service (OOPS) by setting the EFER_LME bit in the EFER MSR. The issue affects kernel versions before 2.6.29.1 and is tied to...

CVE-2009-3638

CVE-2009-3638 affects the Linux kernel KVM subsystem: integer overflow in kvm_dev_ioctl_get_supported_cpuid (arch/x86/kvm/x86.c) allows local users to trigger an unspecified impact via KVM_GET_SUPPORTED_CPUID requests. Affected versions are Linux kernels before 2.6.31.4. Remediation is to upgrade...

CVE-2009-4895

CVE-2009-4895 describes a race condition in the Linux kernel's tty_fasync path (drivers/char/tty_io.c) prior to 2.6.32.6, enabling local users to cause a denial of service via a NULL pointer dereference and system crash. The issue is tied to put_tty_queue and __f_setown, with a note that it was a...

CVE-2010-2478

CVE-2010-2478: The Linux kernel before 2.6.33.7 on 32-bit platforms has an integer overflow in ethtool_get_rxnfc(), triggered by a large info.rule_cnt via ETHTOOL_GRXCLSRLALL. Local users can cause a denial of service or potentially other impact (as described in the connected Mirage/Linux advisor...

CVE-2010-3448

CVE-2010-3448 affects the Linux kernel’s ThinkPad ThinkPad ACPI driver (drivers/platform/x86/thinkpad_acpi.c) on ThinkPad systems using X.Org prior to 2.6.34. The issue allows a local attacker to access and manipulate the video output control state without proper restriction, enabling a denial of...

CVE-2010-4161

CVE-2010-4161 affects the Linux kernel 2.6.18 build used by Red Hat Enterprise Linux 5. The issue lies in udp_queue_rcv_skb in net/ipv4/udp.c, where a crafted socket filter and UDP traffic can trigger a denial of service (deadlock/system hang). The related CVE-2010-4158 is referenced. Connected d...

CVE-2010-4563

The Connected documents provide concrete detail for CVE-2010-4563: when the Linux kernel handles IPv6, an attacker can probe for sniffing by sending an ICMPv6 Echo Request to a multicast address and observing whether an Echo Reply is returned (as shown by thcping). This affects the Linux kernel’s...

CVE-2010-4805

CVE-2010-4805 affects the Linux kernel socket backlog handling in net/core/sock.c prior to 2.6.35, allowing remote DoS via large traffic (backlog management related to sk_add_backlog and sk_rmem_alloc). The entry notes this vulnerability exists due to an incomplete fix for CVE-2010-4251. The conn...

CVE-2011-1019

The CVE-2011-1019 issue affects the Linux kernel up to version 2.6.38, where dev_load in net/core/dev.c allows local users with CAP_NET_ADMIN to bypass CAP_SYS_MODULE and load arbitrary modules. This constitutes a local privilege escalation. Remediation is to upgrade to kernel 2.6.38 or newer (as...

CVE-2011-1173

CVE-2011-1173 affects the Linux kernel on x86_64 prior to 2.6.39. The vulnerability is in the econet_sendmsg function (net/econet/af_econet.c) and allows a remote attacker to read uninitialized data from kernel stack memory via an Acorn Universal Networking (AUN) packet, enabling information disc...