CVE-2024-42251

CVE-2024-42251 is a Linux kernel vulnerability that was resolved by removing folio_try_get_rcu() from mm: page_ref. The issue manifested as a kernel bug (invalid opcode) in non-SMP builds and was fixed in the upstream kernel (mm/gup.c) with the change in include/linux/page_ref.h:275. Affected com...

CVE-2024-42293

The CVE-2024-42293 entry concerns the Linux kernel (arm64) vulnerability in the memory management code related to lockless walking with static/dynamic page-table folding. The issue arises when 16K pages with a 4-level page-table fold at runtime; the generic p4d_offset_lockless() would return a po...

CVE-2024-44980

CVE-2024-44980 relates to the Linux kernel’s DRM/ XE opregion handling. The advisory reports a leak in opregion cleanup within xe_display_init_noirq/ intel_opregion_setup, traced to kmemleak_alloc/kmalloc_trace_noprof paths, resulting in an unreferenced object during probe/modprobe cleanup. The b...

CVE-2024-44997

CVE-2024-44997 affects the Linux kernel’s net: ethernet: mtk_wed component. The issue is a use-after-free/panic in MT798X when turning down an interface on a band with multiple AP interfaces and WED enabled. The root cause: cb_priv was freed in mtk_wed_setup_tc_block() without nulling the pointer...

CVE-2024-47729

CVE-2024-47729 affects the Linux kernel DRM-XE path. Affected component: user binds mapping to engines that can fault; the completion order can cause a deadlock between user binds and faulting devices. Root cause: binding to engines on faulting devices can deadlock due to how fault handling inter...

CVE-2025-21644

CVE-2025-21644: Linux kernel DRM/xe tlb_invalidation bug. Root cause: GuC load failure could leave initialization incomplete, leading to NULL pointer dereference during wedging. Fix: move xe_gt_tlb_invalidation_init() to xe_gt_init_early() so locks/seqno are initialized early (software-only init)...

CVE-2025-21709

CVE-2025-21709 — Linux kernel vulnerability. Root cause: a dup_mmap() allocation failure can leave the maple tree in an unsafe state, enabling a partially initialised mm_struct to be observed via rmap, and a race related to uprobes remains after prior fixes. The patch introduces MMF_OOM_SKIP to a...

CVE-2025-21965

CVE-2025-21965 affects the Linux kernel sched_ext path used with BPF schedulers. If a BPF scheduler provides an invalid CPU (outside nr_cpu_ids) as prev_cpu to scx_bpf_select_cpu_dfl(), it can crash the kernel. The fix validates prev_cpu in scx_bpf_select_cpu_dfl() and triggers an scx error for i...

CVE-2025-21987

CVE-2025-21987: In Linux kernel DRM/AMDGPU, the bug is in init return value in amdgpu_ttm_clear_buffer; an uninitialized value could be returned if amdgpu_res_cleared returns true for all regions. The issue has been fixed via a cherry-picked commit (commit 7c62aacc3b452f73a1284198c81551035fac6d71...

CVE-2025-37848

The CVE-2025-37848 fix applies to the Linux kernel accel/ivpu MS IOCTLs path. It resolves a PM-related deadlock where runtime resume/suspend can be blocked while MS IOCTLs are in progress; a failed suspend would trigger ivpu_ms_cleanup() which attempts to acquire file_priv->ms_lock that is alr...

CVE-2025-38088

CVE-2025-38088 affects the Linux kernel’s memtrace mmap in the PowerPC powernv memory tracing path. The root cause is an out-of-bounds issue when mmap-ing within the memtrace region. The patch fixes this by validating that the requested mapping size does not exceed the allocated memtrace region, ...

CVE-2025-38153

CVE-2025-38153 (Linux kernel) is documented in connected sources as a vulnerability in the aqc111 USB network driver. The issue arises from incomplete sanitation of usbnet read results, where usbnet_read_cmd() may return fewer bytes than expected and aqc111_read_cmd() may not validate the result,...

CVE-2025-38158

CVE-2025-38158 affects the Linux kernel (hisi_acc_vfio_pci) and fixes an XQE/AEQE DMA address error observed after migration. The root cause is an incorrect address construction when reading hardware registers, causing wrong DMA addresses for EQE/AEQE and guest kernel‑mode encryption services to ...

CVE-2025-38182

CVE-2025-38182 affects the Linux kernel ublk (userspace block driver). The connected advisories confirm the issue is fixed in the kernel by sanitizing arguments from userspace when adding a device and by sanity-checking the queue depth/number of queues obtained from userspace. Root cause: inadequ...

CVE-2025-38222

Summary : CVE-2025-38222 refers to a Linux kernel vulnerability in ext4 inline data handling. When inline_data is enabled, a length parameter (len) is incorrectly treated as an unsigned int, causing a truncation of pos+len in ext4_prepare_inline_data. This leads to an incorrect len being passed t...

CVE-2025-38263

The CVE-2025-38263 issue in the Linux kernel affects the bcache subsystem, specifically a NULL pointer dereference in cache_set_flush() that could occur during error handling in register_cache_set()/bch_cache_set_alloc(). The crash path can lead to kernel oops and a NULL dereference when cache se...

CVE-2025-38324

CVE-2025-38324 : The Linux kernel fix addresses a race in mpls_route_input_rcu() that could be triggered when called from mpls_getroute() under RTNL, where net->mpls.platform_label is updated under RTNL. The patch switches to rcu_dereference_rtnl() to silence the spurious lockdep warning and e...

CVE-2025-38343

CVE-2025-38343 relates to the Linux kernel wifi mt76 mt7996 handling of 802.11 fragmentation. A patch ensures multicast/broadcast frames are not fragmented, since IEEE 802.11 fragmentation is limited to unicast frames; this addresses the underlying issue referenced by CVE-2020-26145. Connected so...

CVE-2025-38495

CVE-2025-38495 affects the Linux kernel HID core. The allocated HID report buffer did not account for the reserved report ID byte, causing only 7 guaranteed bytes instead of 8. A fix ensures the buffer can contain the reserved ID. Upstream commits resolve this; upgrade to a kernel version that in...

CVE-2025-38555

The CVE CVE-2025-38555 is a use-after-free in Linux kernel USB gadget driver during composite_dev_cleanup, arising when configfs_composite_bind() frees cdev->os_desc_req on kmalloc failure but doesn’t NULL it, leading to a subsequent use of non-NULL pointer. The issue affects the usb gadget’s ...

CVE-2025-38707

CVE-2025-38707 is a Linux-kernel NTFS3 file-name sanity-check vulnerability. The issue arises from a too-long file name not being validated against the directory-entry size, potentially enabling local escalation when processing NTFS names. The CVE entry in the initial doc shows a HIGH impact with...

CVE-2026-23003

CVE-2026-23003 : In the Linux kernel’s IPv6 tunnel receive path (ip6_tunnel, __ip6_tnl_rcv), VLAN encapsulations were not handled correctly due to a failed VLAN-aware pull in the decapsulation path. The fix substitutes skb_vlan_inet_prepare() for pskb_inet_may_pull() to properly accommodate VLAN-...

CVE-2026-31787

CVE-2026-31787 affects the Linux kernel, specifically the xen/privcmd mapping flow. The root cause is a double-free in the VMA splitting path when userspace performs partial munmap() on a privcmd mapping. Because privcmd_vm_ops defines .close but not .may_split or .open, the kernel may_split() pe...

CVE-2005-2490

CVE-2005-2490 describes a stack-based buffer overflow in the Linux kernel 2.6 sendmsg() path prior to 2.6.13.1. Local users could cause arbitrary code execution by calling sendmsg and altering message contents in another thread. Public sources in the connected documents corroborate the vulnerabil...

CVE-2005-3053

The CVE-2005-3053 issue is a Linux kernel 2.6.x local vulnerability where set_mempolicy accepts a negative first argument, triggering a BUG() and a potential denial of service. The Debian DSAs enumerate CVE-2005-3053 among several local/remote problems in kernel-source-2.6.8 and recommend upgradi...

CVE-2007-3642

The vulnerability CVE-2007-3642 affects the Linux kernel and is tied to the decode_choice function in nf_conntrack_h323_asn1.c. It allows remote attackers to trigger a denial of service (crash) by providing an encoded, out-of-range index for a choice field, causing a NULL pointer dereference. Aff...

CVE-2009-0835

Summary (CVE-2009-0835) in the Linux kernel (2.6.28.7 and earlier on x86_64) describes a local privilege issue within the seccomp filter. The __secure_computing function does not correctly handle calls where a 32‑bit process makes a 64‑bit syscall or a 64‑bit process makes a 32‑bit syscall, allow...

CVE-2009-2767

CVE-2009-2767 affects the Linux kernel up to version 2.6.31-rc6. The init_posix_timers function in kernel/posix-timers.c mishandles CLOCK_MONOTONIC_RAW clock_nanosleep, triggering a NULL pointer dereference and enabling local users to cause a denial of service (OOPS) or potentially gain privilege...

CVE-2010-3448

CVE-2010-3448 affects the Linux kernel’s ThinkPad ThinkPad ACPI driver (drivers/platform/x86/thinkpad_acpi.c) on ThinkPad systems using X.Org prior to 2.6.34. The issue allows a local attacker to access and manipulate the video output control state without proper restriction, enabling a denial of...

CVE-2011-1019

The CVE-2011-1019 issue affects the Linux kernel up to version 2.6.38, where dev_load in net/core/dev.c allows local users with CAP_NET_ADMIN to bypass CAP_SYS_MODULE and load arbitrary modules. This constitutes a local privilege escalation. Remediation is to upgrade to kernel 2.6.38 or newer (as...

CVE-2011-1479

CVE-2011-1479 : A double-free in the Linux kernel’s inotify subsystem (kernel versions before 2.6.39) allows local users to crash the system via paths involving failed file creation. The issue stems from an incorrect fix related to CVE-2010-4250. Affected product: Linux kernel; vulnerability type...

CVE-2011-1493

CVE-2011-1493 affects the Linux kernel (before 2.6.39). The vulnerable code is in rose_parse_national (net/rose/rose_subr.c), where an array index error can be triggered by a FAC_NATIONAL_DIGIS entry that specifies many digipeaters. This can cause heap memory corruption and a remote denial of ser...

CVE-2011-1581

CVE-2011-1581 affects the Linux kernel bonding driver (drivers/net/bonding/bond_main.c). When a network device with many receive queues is installed and the default tx_queues is used, the code fails to properly constrain queue indexes, enabling a remote attacker to cause a denial of service or sy...

CVE-2013-3223

The CVE-2013-3223 issue affects the Linux kernel: the ax25_recvmsg function in net/ax25/af_ax25.c does not initialize a certain data structure, allowing local attackers to read sensitive information from kernel stack memory via crafted recvmsg or recvfrom calls. Affected kernel versions are befor...

CVE-2013-3235

Mitigation-ready summary for CVE-2013-3235: In the Linux kernel, net/tipc/socket.c prior to 3.9-rc7 does not initialize a certain data structure and a length variable, enabling local attackers to read sensitive data from kernel stack memory via crafted recvmsg/recvfrom. Affected scenario is local...

CVE-2013-7027

The CVE-2013-7027 entry concerns the Linux kernel vulnerability in the ieee80211_radiotap_iterator_init function (net/wireless/radiotap.c) prior to 3.11.7. The issue is that the code does not validate whether a frame contains data outside of the header, which may allow an attacker to trigger a de...

CVE-2015-7885

CVE-2015-7885 affects the Linux kernel: the dgnc_mgmt_ioctl function in drivers/staging/dgnc/dgnc_mgmt.c does not initialize a certain structure member, enabling a local attacker to read sensitive kernel memory via a crafted application. The issue is scoped to kernels up to version 4.3.3. Connect...

CVE-2017-0576

CVE-2017-0576 is an elevation-of-privilege vulnerability in the Qualcomm Crypto Engine Driver that could allow a local malicious app to execute arbitrary code in the kernel context. Affected product scope is Android; kernels 3.10 and 3.18 are listed as vulnerable. The underlying issue is in the Q...

CVE-2017-18549

CVE-2017-18549 affects the Linux kernel component drivers/scsi/aacraid/commctrl.c in versions prior to 4.13. The root cause is that aac_send_raw_srb does not initialize the reply structure, which can lead to exposure of kernel stack memory. The connected Nessus entries (Unity Linux advisories) re...

CVE-2018-12633

CVE-2018-12633 affects the Linux kernel up to 4.17.2, where vbg_misc_device_ioctl() in drivers/virt/vboxguest/vboxguest_linux.c double-fetches header data from user input via copy_from_user. A race condition lets a local attacker tamper with hdr.size_in and hdr.size_out between fetches, enabling ...

CVE-2018-20449

CVE-2018-20449 affects the Linux kernel 4.14.90, specifically the hidma_chan_stats function in drivers/dma/qcom/hidma_dbg.c. It allows local users to obtain sensitive address information by reading callback= lines in a debugfs file. The issue is evidenced across multiple feeds (NVD, Red Hat, SUSE...

CVE-2019-9857

CVE-2019-9857 affects the Linux kernel up to 5.0.2: inotify_update_existing_watch() in fs/notify/inotify/inotify_user.c omits calling fsnotify_put_mark() with IN_MASK_CREATE after fsnotify_find_mark(), causing a memory leak (refcount leak) and ultimately a denial of service. The connected Nessus/...

CVE-2020-27784

CVE-2020-27784 is a use-after-free in the Linux kernel’s printer_ioctl path. The issue arises from accessing a deallocated printer_dev instance after it has been freed by gprinter_free(), enabling a local attacker to trigger a fault in the kernel. The vulnerability is tracked with CVSSv3.1 vector...

CVE-2021-47139

CVE-2021-47139 affects the Linux kernel hns3 driver. A race occurs because the netdevice is registered before client initialization completes, creating a window where changes to channels or rx CPU map can trigger hns3_set_rx_cpu_rmap() twice, leading to a crash (BUG at lib/cpu_rmap.c). The fix, a...

CVE-2021-47150

CVE-2021-47150 is a Linux kernel issue in the network driver fec/enet: the fix addresses a potential memory leak in fec_enet_init(). When cbd_base allocation fails, memory allocated for the queues must be freed; otherwise a leak occurs. If allocation for the queues fails, the function now returns...

CVE-2021-47159

CVE-2021-47159 — In the Linux kernel net/dsa path, a crash could occur if ds->ops->get_sset_count() returns a negative error (e.g., -EOPNOTSUPP). Because i is unsigned, the negative value is promoted to a large positive, causing memory corruption in the loop. The fix changes i to a signed i...

CVE-2021-47248

The CVE-2021-47248 entry concerns a race in the Linux kernel UDP path between close() and udp_abort(). The root cause is udp_abort() racing with close(), with both paths acquiring the socket lock, while udp{v6}_destroy_sock() releases it before performing destructive actions. The fix uses the SOC...

CVE-2021-47361

CVE-2021-47361 – Linux kernel mcb_alloc_bus() use-after-free fix. The vulnerability arises from two bugs in mcb_alloc_bus(): (1) calling put_device(carrier) after ida_simple_get() failure without a prior get_device(), risking use-after-free; (2) not balancing device lifecycles after device_initia...

CVE-2021-47364

Summary (CVE-2021-47364) The Linux kernel vulnerability in the comedi subsystem affects the 32-bit version of the COMEDI_INSNLIST ioctl when CONFIG_COMPAT is enabled. The issue is a memory leak in compat_insnlist(): memory was allocated to hold a converted array of struct comedi_insn and only fre...

CVE-2021-47513

CVE-2021-47513 is a Linux kernel vulnerability affecting the net: dsa: felix MMIO filtering path. The issue is a memory leak in felix_setup_mmio_filtering that occurs if there is no CPU port defined. The vulnerability is fixed in the kernel by addressing the resource leak in the felix MMIO filter...