CVE-2006-6304

The CVE-2006-6304 issue affects Linux kernel 2.6.19 where do_coredump in fs/exec.c sets the O_EXCL flag but does not use it, enabling a context-dependent attacker to modify arbitrary files via a core-dump rewrite attack. A fix is available in the kernel changelog (2.6.19.1) and related advisories...

CVE-2025-38428

CVE-2025-38428 : In the Linux kernel, the vulnerability affects the ims-pcu path where the firmware-provided length (len) is used in memcpy to fragment data in ims_pcu_flash_firmware(). If len is too large, memory corruption can occur. The issue arises from trusting firmware input; the fixed vers...

CVE-2025-38430

This CVE-2025-38430 affects the Linux kernel and is addressed by a patch that makes nfsd4_spo_must_allow() verify that the RPC procedure is NFSPROC4_COMPOUND. If the request is not a v4 compound, examining cstate could yield undefined results; the patch enforces the proper rq_procinfo for v4 comp...

CVE-2025-38458

The CVE-2025-38458 entry concerns the Linux kernel vulnerability in atm/clip: a NULL pointer dereference in vcc_sendmsg(), which can lead to a kernel crash (OOPS) when atmarpd_dev_ops does not implement the send method. The provided trace shows a NULL address dereference and a call path through v...

CVE-2025-38475

CVE-2025-38475 concerns the Linux kernel SMC socket type confusion where smc_sock hijacks AF_INET/AF_INET6 internals, causing inet_opt to be interpreted as a function pointer due to inet_sock not being the first member of smc_sock. The root cause is the misalignment between smc_sock and inet_sock...

CVE-2026-23455

TL;DR : CVE-2026-23455 is a Linux kernel vulnerability in netfilter nf_conntrack_h323, fixed by adding a check so the decoded length remains positive after subtracting the protocol discriminator. Affected component : Linux kernel, nf_conntrack_h323 DecodeQ931() UserUserIE path. Root cause : The d...

CVE-2004-0109

CVE-2004-0109 describes a buffer overflow in the Linux kernel ISO9660 filesystem for 2.4/2.5/2.6, allowing local users with physical access to overflow kernel memory and execute arbitrary code via a malformed CD containing a long symbolic link entry. The connected documents do not provide additio...

CVE-2004-0565

CVE-2004-0565 affects Linux 2.4.x kernel code where the MFH bit is checked without verifying the FPH owner in the context switch path. This enables local attackers to read register values of other processes, exposing partial confidentiality. The vulnerability description explicitly states the iss...

CVE-2005-4811

CVE-2005-4811 concerns the Linux 2.6 kernel hugepage code (hugetlb.c). In certain configurations, a local user could trigger an mmap error before a prefault, causing an error in unmap_hugepage_area and potentially crash the system (local DoS). The connected advisories confirm this as a kernel fla...

CVE-2006-0744

CVE-2006-0744 affects the Linux kernel before 2.6.16.5. The issue arises from handling uncanonical return addresses on Intel EM64T CPUs, where an exception is reported in SYSRET instead of the next instruction, causing the kernel exception handler to run on the user stack with an incorrect GS. Im...

CVE-2006-1863

CVE-2006-1863 is a directory traversal vulnerability in CIFS on Linux 2.6.16 and earlier that allows a local user to escape chroot restrictions for an SMB-mounted filesystem via "..\" sequences. The issue is mitigated by applying a kernel update (e.g., as per ChangeLog-2.6.16.11). Mode: C (detail...

CVE-2006-2451

The CVE-2006-2451 issue affects Linux kernel 2.6.13 up to 2.6.17.4 inclusive, and 2.6.16 up to 2.6.16.24, where the suid_dumpable handling enables a local user to cause disk-based denial of service and potentially gain privileges via PR_SET_DUMPABLE when a core dump is created in a directory the ...

CVE-2006-3741

CVE-2006-3741 concerns the perfmonctl (sys_perfmonctl) system call in Linux kernels 2.4.x and 2.6.x prior to 2.6.18 on Itanium. The issue is an improper reference-count accounting for file descriptors, which can allow local users to exhaust file descriptors and cause a denial of service. The desc...

CVE-2006-6106

The CVE-2006-6106 entry describes several buffer overflows in the Bluetooth driver (net/bluetooth/cmtp/capi.c) of the Linux kernel, specifically in the cmtp_recv_interopmsg function. Affected products/versions include Linux kernel 2.4.22 up to 2.4.33.4 and 2.6.2 up to 2.6.18.5, with 2.6.19.x also...

CVE-2008-0009

The CVE-2008-0009 entry is supported by connected documents: it affects Linux kernel 2.6.22–2.6.24 where vmsplice_to_user dereferences a userspace pointer without validation, enabling local access to kernel memory. The issue is a local privilege‑escalation vulnerability; remediation is associated...

CVE-2008-2372

CVE-2008-2372 affects the Linux kernel versions 2.6.24 and 2.6.25 before 2.6.25.9. The root cause is a lack of ZERO_PAGE optimization in get_user_pages, causing the allocation of many useless newly zeroed pages and enabling a local user to trigger a denial of service through memory exhaustion. Th...

CVE-2008-2729

CVE-2008-2729 affects the Linux kernel before 2.6.19 on some AMD64 systems. The issue is in arch/x86_64/lib/copy_user.S where, after a kernel memory copy exception, destination memory locations aren’t erased, potentially letting a local user read residual data. Impact: local information disclosur...

CVE-2009-4271

CVE-2009-4271 affects Linux kernel 2.6.9–2.6.17 on x86_64/amd64. A local unprivileged user can trigger a NULL pointer dereference when a crafted 32-bit process calls mprotect on the Virtual Dynamic Shared Object (VDSO) page, potentially causing a kernel panic (DoS). The issue is tied to memory pr...

CVE-2010-1643

CVE-2010-1643 affects the Linux kernel mm/shmem.c: when strict overcommit is enabled, export of shmemfs objects by knfsd is mishandled, allowing a denial of service via NULL pointer dereference and knfsd crash. The issue is fixed in the 2.6.28‑rc3 update (and later); affected users should upgrade...

CVE-2013-4254

The CVE-2013-4254 issue affects the Linux kernel on ARM where the validate_event function in arch/arm/kernel/perf_event.c before 3.10.8 can be triggered by adding a hardware event to an event group led by a software event, allowing local privilege escalation or causing a NULL pointer dereference ...

CVE-2016-10764

In CVE-2016-10764, the vulnerability is in the Linux kernel before 4.9.6: the cadence-quadspi.c file in drivers/mtd/spi-nor contains an off-by-one error in cqspi_setup_flash() where the f_pdata array uses CQSPI_MAX_CHIPSELECT elements and the comparison should be >= instead of >. This is co...

CVE-2016-9919

The CVE-2016-9919 entry concerns the Linux kernel y icmp6_send in net/ipv6/icmp.c, vulnerable through kernel version 4.8.12. The flaw omits a check of the dst data structure, allowing remote attackers to trigger a denial of service (panic) by sending a fragmented IPv6 packet. Connected advisories...

CVE-2017-5546

CVE-2017-5546 affects Linux kernel 4.8.x and 4.9.x prior to 4.9.5. The freelist-randomization feature in mm/slab.c can be triggered by selecting a large random number, leading to duplicate freelist entries and a potential denial of service (system crash) or other impact in opportunistic circumsta...

CVE-2018-20510

CVE-2018-20510 affects the Linux kernel 4.14.90, where the print_binder_transaction_ilocked function in drivers/android/binder.c can allow a local user to read sensitive address information from a debugfs file by exploiting the *from *code *flags lines. Connected Nessus advisories reiter this exa...

CVE-2021-47106

CVE-2021-47106 concerns a Linux kernel nf_tables use-after-free in nft_set_catchall_destroy, caused by accessing catchall after kfree_rcu(). The fix requires using a safe iterator (list_for_each_entry_safe) to walk the set elements. Syzbot reported KASAN use-after-free in nft_set_catchall_destroy...

CVE-2021-47109

CVE-2021-47109 concerns the Linux kernel neighbour GC: on IPv6, NUD_NOARP entries can be GCed, potentially overflowing the neighbour table for valid connections. The description notes the issue is more prevalent after the patch with commit 58956317c8de (“neighbor: Improve garbage collection”), wh...

CVE-2021-47214

CVE-2021-47214 affects Linux kernel hugetlb/userfaultfd handling. The fix corrects reservation restoration on userfaultfd error in hugetlb_mcopy_atomic_pte() by treating the is_continue path like pagecache insertion and altering the new_pagecache_page flag (renamed to page_in_pagecache) so restor...

CVE-2021-47302

In CVE-2021-47302, the Linux kernel igc driver is affected by a use-after-free during TX ring reset. The fix cleans the next_to_watch descriptor when cleaning the TX ring, preventing a possible free of an skb that was already freed if igc_poll() runs during a reset. The described impact is memory...

CVE-2021-47305

In CVE-2021-47305, the Linux kernel’s dma-buf/sync_file implementation leaks fences on error paths due to missing dma_fence_put() calls when merging fences and in krealloc_array failure. The fix ensures i and the fences array are zero-initialized and that all fences are dma_fence_put() and the fe...

CVE-2021-47370

CVE-2021-47370 affects the Linux kernel and concerns the MPTCP path: a signed/unsigned comparison in the code path that refills the TX cache can misbehave when size_goal is smaller than skb->len, causing the core TCP path to allocate an skb without the MPTCP extension. The fix rewrites the exp...

CVE-2021-47417

CVE-2021-47417 refers to a Linux kernel memory-leak issue in libbpf’s strset management. The vulnerability arises from freeing only internal parts previously, not the strset structure itself, allowing a memory leak. The CVE description and connected advisories confirm this root cause and indicate...

CVE-2021-47448

CVE-2021-47448 affects the Linux kernel’s MPTCP path: recvmsg() with MSG_WAITALL can stall when not enough data is available, leaving mptcp_wait_data() in a state where MPTCP_DATA_READY is set but never cleared, which can trigger an RCU stall. The bug is in the mptcp_recvmsg/mptcp_wait_data path ...

CVE-2021-47523

CVE-2021-47523 affects the Linux kernel’s IB/hfi1 path. The issue is a leak of rcvhdrtail_dummy_kvaddr which is allocated in hfi1_init() and can be overwritten on a reinit path, leading to a memory leak. The fix moves the allocation to hfi1_alloc_devdata() and deallocation to hfi1_free_devdata(),...

CVE-2021-47526

CVE-2021-47526 is a Linux kernel vulnerability in the serial: liteuart driver causing a NULL pointer dereference in _remove() when drvdata isn’t set in _probe(). The root cause is missing drvdata assignment which leads to platform_get_drvdata() returning NULL in _remove(). The issue affects the L...

CVE-2021-47529

CVE-2021-47529: Linux kernel vulnerability in iwlwifi memory management where memory allocated in reduce_power_data could leak on error (invalid TLV len or memory allocation failure). The issue has been fixed in the Linux kernel by freeing allocated memory in the error path before return. Connect...

CVE-2022-48644

Summary (CVE-2022-48644): A Linux kernel net/sched taprio offload bug could crash the kernel when disabling offload if flags were left at TAPRIO_FLAGS_INVALID after an error path. The code evaluated FULL_OFFLOAD_IS_ENABLED(q->flags) on an invalid flag value (U32_MAX), causing a crash when tapr...

CVE-2022-48649

CVE-2022-48649 is a Linux kernel vulnerability affecting the kmem_cache lifecycle in mm/slab_common. The issue stems from a race where, during kmem_cache_destroy, a scheduled work item (kmem_cache_release) could run with an incorrect RCU flag value, potentially causing a double kmem_cache_release...

CVE-2022-48667

The connected documents confirm CVE-2022-48667 affects the Linux kernel SMB3 insert-range path, where an affected cached region is not discarded, risking temporary file data corruption. The issue has been fixed in kernel code (see related commits and advisories from Astra Linux, SUSE, Microsoft, ...

CVE-2022-48724

CVE-2022-48724 concerns a memory leak in the Linux kernel’s IOMMU VT-d path during intel_setup_irq_remapping. The description in multiple connected documents states that after commit e3beca48a45b, the tear-down path could leak memory when dmar_enable_qi() errors, and that free() of the function p...

CVE-2022-48751

CVE-2022-48751 pertains to the Linux kernel net/smc code, where a race on clcsock could allow access to a window where clcsock had been released, causing a NULL pointer dereference in smc_setsockopt. The documented fix introduces clcsock_release_lock protection and checks that clcsock is not rele...

CVE-2022-48755

The CVE-2022-48755 issue is a Linux kernel vulnerability affecting powerpc64 systems where BPF code could emit ldbrx instructions not supported on processors older than ISA v2.06. The root cause is an ISA compatibility gap in the ldbrx path used by BPF_FROM_[L|E] and BPF_FROM_[L|B]E, leading to a...

CVE-2022-48933

CVE-2022-48933 affects the Linux kernel nf_tables stateful object update path. The issue arises when updating stateful objects from the control plane: a temporary object is created, but its destruction path leaks resources because the update flow does not increment the module refcount. The fix is...

CVE-2022-49050

CVE-2022-49050 maps to a Linux kernel issue in memory: renesas-rpc-if where a flash platform-device leak could occur in the error path if registration fails during probe. The fixed code ensures the flash platform device is freed on probe error. The vulnerability is local in scope with a medium ba...

CVE-2022-49077

CVE-2022-49077 — Linux kernel : A vulnerability where an mremap(old_size=0) path could reach move_page_tables() and trigger unnecessary invalidate_range_start()/invalidate_range_end() on an empty range, causing a WARN in KVM mmu_notifier. The published fix is to short‑circuit with an early return...

CVE-2022-49088

CVE-2022-49088 affects the Linux kernel: a refcount leak in dpaa2_ptp_probe where the of_find_compatible_node() result is returned with an incremented refcount. The fix is to call of_node_put() to release the reference and avoid the leak. References point to kernel patches that implement this cor...

CVE-2022-49252

Technical details for CVE-2022-49252 are not present in the provided documents. The connected Astra/SUSE/EUVD entries reference kernel issues but do not disclose specifics for this CVE. Monitor for updates in the supplied feeds.

CVE-2022-49400

CVE-2022-49400 concerns a Linux kernel RAID subsystem issue where in reshape the code path freed the mddev and set mddev->private to NULL, causing NULL dereference when a new raid tried to reuse mddev. The fix is to remove the code path that sets mddev->private to NULL in raid0_free, preven...

CVE-2022-49450

CVE-2022-49450 relates to the Linux kernel AF_RXRPC listen() backlog handling. The underlying issue is that the backlog can be configured up to 32, but the preallocation ring has 32 slots and one slot is always dead due to the ring using CIRC_CNT(). This caused an oops on socket close when listen...

CVE-2022-49477

CVE-2022-49477 affects the Linux kernel’s ASoC Samsung code for aries_audio_probe. The vulnerability arises from a refcount leak: of_parse_phandle() returns a node pointer with an incremented refcount, and of_node_put() must be called on it when done. If extcon_find_edev_by_node() fails, of_node_...

CVE-2022-49485

CVE-2022-49485 describes a Linux kernel issue in drm/v3d: a null pointer dereference of pointer perfmon where WARN_ON happens after the pointer has been dereferenced. The fix is to dereference perfmon only after it has been null-checked. Affected component: Linux kernel (drm/v3d path). Impact, pe...