CVE-2025-38225

CVE-2025-38225 is a Linux kernel issue affecting the media: imx-jpeg driver, where failures to clean up after an allocation error can cause buffers to remain uninitialized and lead to NULL pointer dereferences. The vulnerability is resolved in upstream kernel fixes, with Debian and other vendors ...

CVE-2025-38251

CVE-2025-38251 refers to a NULL-dereference in the Linux kernel ATM clip subsystem (clip_push) when clip_devs is NULL, caused by vcc_destroy_socket() calling clip_push() with a NULL skb. The vulnerability is fixed by upstream commits cited in the CVE entry and is reflected in multiple advisories ...

CVE-2025-38264

CVE-2025-38264 applies to the Linux kernel and concerns the nvme-tcp subsystem. The vulnerability arises from improper handling in nvme_tcp_handle_r2t(), where an R2T PDU could be validated as part of a list, allowing a malicious input to inject a loop in request list processing. The description ...

CVE-2025-38285

CVE-2025-38285 – Linux kernel : The issue stems from a WARN_ON_ONCE in the BPF tracing path (get_bpf_raw_tp_regs) triggered by a corner case involving trace_mmap_lock and stack maps. The issue surfaces during BPF stack retrieval and is reported in kernel/bpf_trace.c, with inline calls in bpf_get_...

CVE-2025-38289

The CVE-2025-38289 entry concerns the Linux kernel SCSI lpfc driver. It describes a potential use-after-free of an ndlp object in dev_loss_tmo_callbk during driver unload or fatal error handling, leading to a Denial of Service if triggered. The fix reorders code to avoid use-after-free when the i...

CVE-2025-38290

CVE-2025-38290 (Azure Linux 3.0 kernel) : A WLAN recovery race in ath12k caused possible kernel panic due to node corruption in arvifs during vif removal. The fix reinitializes all arvifs list nodes when WLAN halts, preventing list_del() from operating on an invalid node. Affected platform is the...

CVE-2025-38324

CVE-2025-38324 : The Linux kernel fix addresses a race in mpls_route_input_rcu() that could be triggered when called from mpls_getroute() under RTNL, where net->mpls.platform_label is updated under RTNL. The patch switches to rcu_dereference_rtnl() to silence the spurious lockdep warning and e...

CVE-2025-38335

CVE-2025-38335 concerns a Linux kernel vulnerability in the gpio_keys driver related to PREEMPT_RT. The description states that when PREEMPT_RT is enabled, gpio_keys_irq_timer() can run in hard IRQ context while input_event() uses a spin_lock, which is incompatible with hard IRQ. This leads to a ...

CVE-2025-38344

CVE-2025-38344 relates to ACPICA in the Linux kernel where ACPI cache leaks were fixed. Technical details in connected docs show memory leaks in Acpi-State, Acpi-Parse, and Acpi-parse_ext caches due to merging of slabs and use of KMEM cache flags (SLAB_NEVER_MERGE). The root cause was leaks in ea...

CVE-2025-38346

CVE-2025-38346: Linux kernel ftrace UAF when lookup kallsyms after ftrace is disabled. Root cause: use-after-free accessing mod->name during module removal when ftrace_disable is active. Impact per CVSS: Local access with Low privileges required, High confidentiality/integrity/availability imp...

CVE-2025-38364

CVE-2025-38364 pertains to Linux kernel Maple_tree: MA_STATE_PREALLOC handling in mas_preallocate. The flaw prevented allocations when MA_STATE_PREALLOC was set; preallocation checks could undercount, leading to a WARN_ON() and a subsequent null pointer dereference on larger future requests (e.g....

CVE-2025-38406

CVE-2025-38406 affects the Linux kernel wifi driver ath6kl: the vulnerability originates from an unnecessary WARN_ON() when firmware input is bad. The description clarifies that bad firmware input is unrelated to the driver stack and does not constitute an exploitable condition; the fix instead p...

CVE-2025-38448

CVE-2025-38448 is a Linux kernel vulnerability in the USB gadget u_serial wakeup path. The issue is a race condition where gs_start_io() may call gs_start_rx() or gs_start_tx() after briefly dropping port_lock for usb_ep_queue(), allowing gs_close() or gserial_disconnect() to clear port.tty and p...

CVE-2025-38457

CVE-2025-38457 concerns a Linux kernel net/sched bug where grafting a qdisc to a non-existent parent class could cause a failure during qdisc initialization. The fix introduces early validation via qdisc_leaf so that attempting to attach to a non-class parent aborts before qdisc_create. Affected ...

CVE-2025-38467

CVE-2025-38467 affects the Linux kernel DRM/Exynos driver (exynos7_drm_decon). A race condition could cause a kernel NULL pointer dereference during boot when a secondary console device (e.g., TTY serial) is present, leading to a panic. The fix adds a guard to validate that the DRM device can han...

CVE-2025-38478

Technical details for CVE-2025-38478 are not publicly available in the provided documents. The initial report describes Linux kernel Comedi instruction data initialization issues; monitor for updates.

CVE-2025-38481

Technical details for CVE-2025-38481 are not provided in the connected documents. The initial description notes a comedi kernel fix (n_insns limit) but contains no vendor/product/version/exploit details beyond that.

CVE-2025-38487

CVE-2025-38487 relates to the Linux kernel ASPEED SoC LPC snoop driver. The vulnerability arises from disabling channels that aren’t enabled, which can lead to a NULL pointer dereference and a kernel Oops on ARM systems, as illustrated by the provided trace. The Ubuntu/Astra Linux advisory confir...

CVE-2026-52910

The CVE-2026-52910 issue is in the Linux kernel where a cBPF reuseport program may be freed immediately when detached from a reuseport group, without waiting for an RCU grace period. This can lead to a use-after-free and potential memory corruption when a concurrent UDP send crosses the fast path...

CVE-2003-0462

CVE-2003-0462 is a race condition in the Linux 2.4 kernel where env_start/env_end pointers used by the execve path (fs/proc/base.c) can lead to a local denial of service (kernel crash). Documented for several 2.4.x architectures (notably i386/alpha) and tracked in multiple advisories (e.g., Debia...

CVE-2004-0447

Technical details about CVE-2004-0447 are not publicly available in the provided connected documents. Monitor for updates and new advisories.

CVE-2005-0449

Technical details beyond the CVE description are not provided in the connected documents; monitor for updates.

CVE-2005-1768

The CVE-2005-1768 issue is a race condition in the Linux kernel’s IA32 (x86) compatibility execve() handling, affecting amd64/Intel EM64T and Itanium platforms. A concurrent thread can increment a pointer count after nargs has counted pointers but before copying from user space to kernel space, l...

CVE-2007-1861

CVE-2007-1861 affects the Linux kernel prior to 2.6.20.8. The nl_fib_lookup function in net/ipv4/fib_frontend.c can be triggered by NETLINK_FIB_LOOKUP replies, causing infinite recursion and a stack overflow that leads to a kernel panic (denial of service). Open sources in the connected data conf...

CVE-2008-0001

CVE-2008-0001 affects the Linux kernel: VFS in kernels before 2.6.22.16 and 2.6.23.x before 2.6.23.14 tests access permissions using the flag variable instead of the acc_mode flag, potentially allowing a local, unprivileged user to bypass file-write permissions and remove directories. The issue i...

CVE-2008-0010

CVE-2008-0010 concerns the Linux kernel vulnerability in copy_from_user_mmap_sem (fs/splice.c) affecting kernels 2.6.22 through 2.6.24. The root cause is a failure to validate a userspace pointer before dereferencing, which allows a local attacker to read from arbitrary kernel memory locations. A...

CVE-2008-2358

The CVE-2008-2358 entry concerns the Linux kernel DCCP module: an integer overflow in dccp_feat_change within net/dccp/feat.c on kernels 2.6.17–2.6.20 and 2.6.18, enabling a local attacker to trigger a heap-based buffer overflow and gain privileges. Connected advisories reference this issue as pa...

CVE-2011-0463

CVE-2011-0463 affects the OCFS2 code path in the Linux kernel. The issue is in the function ocfs2_prepare_page_for_write where holes crossing page boundaries are not handled correctly, enabling a local user to read potentially sensitive data from uninitialized disk locations. The description indi...

CVE-2011-2942

CVE-2011-2942 is tied to a Red Hat patch affecting the Linux kernel 2.6.18-... on RHEL 5. The issue is in the bridge forward path, specifically br_forward.c __br_deliver, enabling a remote attacker on a bridged network to trigger a NULL pointer dereference and system crash (DoS) or potentially ot...

CVE-2012-5532

The CVE-2012-5532 issue exists in the Linux kernel hypervkvpd hv_kvp_daemon: the main function in tools/hv/hv_kvp_daemon.c allows a local user to trigger a denial of service (daemon exit) via a crafted Netlink message. It is noted as a consequence of an incorrect fix for CVE-2012-2669, and a patc...

CVE-2013-1848

Affected software: Linux kernel (fs/ext3/super.c) before 3.8.4. Root cause: incorrect arguments to functions related to printk input, enabling local users to perform format-string attacks and potentially gain privileges via a crafted application. Impact: local privilege escalation. Remediation: p...

CVE-2014-9895

Technical details for CVE-2014-9895 are not publicly available in the provided documents. The materials reference an information disclosure in media-device.c but do not specify affected versions, root cause, impact, or fixes within this corpus. Monitor for updates.

CVE-2016-2064

The CVE-2016-2064 entry concerns the MSM QDSP6 audio driver (Linux kernel 3.x) in sound/soc/msm/qdsp6v2/msm-audio-effects-q6-v2.c, used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices. The vulnerability arises from an ioctl handling flaw that allows a crafted applicatio...

CVE-2016-5343

CVE-2016-5343 affects the Linux kernel driver drivers/soc/qcom/qdsp6v2/voice_svc.c (QDSP6v2 Voice Service) used in Qualcomm MSM Android contributions. The vulnerability is a buffer overflow in voice_svc_send_req triggered by a write request, which can cause memory corruption and enable a denial o...

CVE-2016-9755

CVE-2016-9755 affects the Linux kernel netfilter IPv6 reassembly logic prior to 4.9. It allows local users to cause a denial of service via a crafted application that uses socket, connect, and writev calls, due to an integer overflow / out-of-bounds write in the IPv6 reassembly path. The root cau...

CVE-2017-0576

CVE-2017-0576 is an elevation-of-privilege vulnerability in the Qualcomm Crypto Engine Driver that could allow a local malicious app to execute arbitrary code in the kernel context. Affected product scope is Android; kernels 3.10 and 3.18 are listed as vulnerable. The underlying issue is in the Q...

CVE-2017-8069

CVE-2017-8069 affects the Linux kernel 4.9.x (prior to 4.9.11). The issue lies in drivers/net/usb/rtl8150.c interacting incorrectly with CONFIG_VMAP_STACK, which may allow a local user to trigger a denial of service (system crash or memory corruption) or other impact by abusing a DMA scatterlist ...

CVE-2021-4218

CVE-2021-4218 concerns a flaw in the Linux kernel related to reading the SVC RDMA counters. The vulnerability occurs when a local attacker with access triggers reading the counter via a sysctl, which panics the system and can cause a denial of service during reboot. The issue is described as spec...

CVE-2021-47083

CVE-2021-47083 affects the Linux kernel’s pinctrl Mediatek code: when the eint virtual EINT number exceeds the GPIO count, it can trigger a global-out-of-bounds write to desc[eint_n]. The issue was fixed in the mediatek pinctrl path (pinctrl: mediatek: fix global-out-of-bounds issue). No exploit ...

CVE-2021-47159

CVE-2021-47159 — In the Linux kernel net/dsa path, a crash could occur if ds->ops->get_sset_count() returns a negative error (e.g., -EOPNOTSUPP). Because i is unsigned, the negative value is promoted to a large positive, causing memory corruption in the loop. The fix changes i to a signed i...

CVE-2021-47196

CVE-2021-47196 concerns a use-after-free in the Linux kernel mlx5_ib path during QP creation. The issue arises when RDMA/core code presets both receive and send completion queue pointers before forwarding to the driver, then overwrites ibqp properties and continues into the driver path. If mlx5_q...

CVE-2021-47262

CVE-2021-47262 concerns the Linux kernel KVM subsystem. The issue arises in the x86 KVM tracepoint handling for nested VM-Enter failures, where string literals used by the “nested VM-Enter failed” tracepoint could outlive memory they reference if the tracepoint is emitted from modules (e.g., kvm-...

CVE-2021-47369

CVE-2021-47369 — Linux kernel (s390/qeth): The issue is a NULL dereference in qeth_clear_working_pool_list() triggered when qeth_set_online() rolls back after an error in qeth_hardsetup_card(), before card->qdio.in_q has been allocated by qeth_alloc_qdio_queues() via qeth_mpc_initialize(). Thi...

CVE-2021-47444

CVE-2021-47444 relates to the Linux kernel DRM/EDID handling. The issue stems from connector_bad_edid() assuming the EDID buffer could hold edid[0x7e] + 1 blocks, while ignoring the actual allocated size indicated by num_blocks. A bounds check was added to prevent reading beyond allocated memory,...

CVE-2021-47471

CVE-2021-47471 affects the Linux kernel, specifically the DRM mxsfb driver. The vulnerability occurs when unloading the driver if mxsfb->crtc.funcs is NULL, causing a NULL pointer dereference by calling mxsfb_irq_disable() via drm_irq_uninstall(). The patch changes the sequence to use mxsfb-&g...

CVE-2021-47539

CVE-2021-47539 affects the Linux kernel RxRPC code. The issue is a use-after-free-like leak where a rxrpc_peer may be leaked during rxrpc_look_up_bundle() when handling a bundle candidate. The provided data states the root cause is a leak of the rxrpc_peer and the remediation is to call rxrpc_put...

CVE-2021-47564

CVE-2021-47564 relates to a Linux kernel issue in the marvell prestera driver where an error-path double free could crash the driver. The vulnerability stems from fixable error-path handling in prestera_bridge_port_join(), leading to a crash on the prestera device (trace includes prestera_bridge_...

CVE-2021-47577

CVE-2021-47577 affects the Linux kernel io-wq subsystem. A race between creating a new worker task_work and wq exit could allow a creation task_work to be added after exit has begun, causing pending work cancellation to not cover that new task. The description states the fix is to check the EXIT ...

CVE-2022-48691

CVE-2022-48691 is a Linux kernel vulnerability affecting nf_tables offload hook handling. The issue arises from clean up of the hook list when offload flag checks fail, enabling a memory leak of an unreferenced object and preventing nft_chain_release_hook() from freeing hooks. The connected Nessu...

CVE-2022-48723

CVE-2022-48723 : In the Linux kernel, the uniphier SPI driver’s probe code leaks refcounts for the dma_rx and dma_tx objects on several error paths when dma_get_slave_caps() or devm_spi_register_master() fail. The leak occurs because the reference count is not decremented in those error paths. Th...