CVE-2025-38016

The CVE-2025-38016 issue concerns the Linux kernel HID-BPF path. Root cause: HID-BPF dispatch may access a cleaned SRCU after hid_bpf_destroy_device() when a device with LEDs is active and hid_ll_driver->request() is unimplemented, causing a potential use-after-free-like access to not-present ...

CVE-2025-38099

CVE-2025-38099 : In the Linux kernel, a SCO Bluetooth connection could lock up the controller if voice settings are not properly read or supported. SUSE/OpenSUSE advisories (e.g., openSUSE-SU-2025-20081-1) list CVE-2025-38099 among fixed kernel vulnerabilities with MEDIUM/LOW to HIGH impact range...

CVE-2025-38132

CVE-2025-38132 : Linux kernel coresight race condition when removing cscfg from csdev. The issue occurs if a module load and config deactivate path races with iterating/removing config_csdev_list entries while holding csdev->cscfg_csdev_lock, allowing an entry delete to race with an active con...

CVE-2025-38139

Technical details about CVE-2025-38139 are not provided in the supplied documents. Monitoring for updates and authoritative advisories is advised.

CVE-2025-38151

Technical details about CVE-2025-38151 are not publicly provided in the supplied documents; no explicit information on affected kernel versions, root cause, impact, or patch is included. Monitor for updates.

CVE-2025-38303

The CVE-2025-38303 issue affects the Linux kernel Bluetooth path: eir_create_adv_data may add EIR_FLAGS and EIR_TX_POWER without validating that they fit, potentially causing a crash. The description states this vulnerability has been resolved in the kernel (fix for crashes in eir_create_adv_data...

CVE-2025-38387

CVE-2025-38387 affects the Linux kernel’s RDMA/mlx5 subsystem. The issue arises when an obj_event is inserted into a list before its obj_sub_list is initialized, risking a poisonous pointer if the event is loaded immediately after insertion. The referenced fix initializes obj_event->obj_sub_li...

CVE-2025-38616

CVE-2025-38616 (Linux kernel TLS ULP issue) affects the kernel TLS path handling data that may disappear from under the TLS ULP when the socket reader predated TLS installation or uses non-standard read APIs. The bug could lead to an out-of-bounds read or TLS state corruption if data is partially...

CVE-2025-39866

CVE-2025-39866 concerns a use-after-free in the Linux kernel’s fs writeback path, specifically __mark_inode_dirty() when the inode’s wb switching occurs. The root cause is a race during switching inode_writeback backends (wb) which can lead to use-after-free via wb_wakeup_delayed() accessing a fr...

CVE-2026-23070

CVE-2026-23070 is an in-kernel issue affecting the Linux kernel (noted in Debian/SUSE advisories) related to Octeontx2-af hardware. The vulnerability stems from missing/insufficient checks for fwdata in the shared firmware structure accessed by the MAC block (CGX/RPM). On boards booted without MA...

CVE-2026-23234

CVE-2026-23234 affects the Linux kernel F2FS subsystem. A use-after-free can occur in f2fs_write_end_io() due to a race with kill_f2fs_super freeing sbi before writeback complete, allowing access to freed sbi during page cache/inode cleanup. The published fix relocates the checkpoint thread wakeu...

CVE-2026-23406

CVE-2026-23406 concerns the AppArmor Linux kernel module. The issue arises in the DFA matching logic used during file path checks, where the macro match_char() can evaluate its character parameter multiple times when traversing differential encoding chains. If invoked with *str++, the string poin...

CVE-2026-46155

CVE-2026-46155 affects the Linux kernel SMB client. The vulnerability is an out-of-bounds read in smb2_compound_op() caused by memcpy reading size[0] (OutputBufferLength) when iov_len is smaller than that length after a truncated server response. This can leak adjacent kernel heap memory. Impact ...

CVE-2004-0394

CVE-2004-0394 concerns a potential buffer overflow in the panic() function of Linux 2.4.x. The description explicitly indicates a possible overflow, but notes it may not be exploitable due to the function’s behavior. The connected OpenVAS entries reference this CVE among broader kernel advisories...

CVE-2004-1137

CVE-2004-1137 affects the Linux kernel 2.4.x (2.4.22–2.4.28) and 2.6.x (up to 2.6.9). The flaws are in IGMP handling (ip_mc_source decrements a counter to -1; igmp_marksources may perform an out-of-bounds read), allowing local or remote attackers to cause denial of service or potentially execute ...

CVE-2005-0449

Technical details beyond the CVE description are not provided in the connected documents; monitor for updates.

CVE-2005-1768

The CVE-2005-1768 issue is a race condition in the Linux kernel’s IA32 (x86) compatibility execve() handling, affecting amd64/Intel EM64T and Itanium platforms. A concurrent thread can increment a pointer count after nargs has counted pointers but before copying from user space to kernel space, l...

CVE-2006-0744

CVE-2006-0744 affects the Linux kernel before 2.6.16.5. The issue arises from handling uncanonical return addresses on Intel EM64T CPUs, where an exception is reported in SYSRET instead of the next instruction, causing the kernel exception handler to run on the user stack with an incorrect GS. Im...

CVE-2006-1052

CVE-2006-1052 affects SELinux ptrace logic in SELinux for Linux 2.6.6. It allows local users with ptrace permissions to change the tracer SID to the SID of another process (local privilege impact). Public advisories (e.g., Debian DSA-1184-1/DSA-1184-2 and RHSA-2006:0575) indicate kernel updates m...

CVE-2007-0958

CVE-2007-0958 : In Linux kernel 2.6.x before 2.6.20, local users can read unreadable binaries by abusing the PT_INTERP interpreter mechanism, triggering a core dump. This is a local-privilege issue; the described impact is to read binaries via core-dump behavior. According to the changelog refere...

CVE-2007-3105

CVE-2007-3105 affects the Linux kernel before 2.6.22, where a stack-based buffer overflow in the RNG can be triggered by setting the default wakeup threshold larger than the output pool size. This may allow local root users to cause a denial of service or gain privileges due to the pool transfer ...

CVE-2007-5904

The CVE-2007-5904 issue is a kernel vulnerability in the CIFS VFS of the Linux 2.6.23 and earlier kernels. It involves multiple buffer overflows triggered by long SMB responses in the SendReceive function, enabling a remote attacker to cause a crash and, potentially, arbitrary code execution. Pub...

CVE-2008-2358

The CVE-2008-2358 entry concerns the Linux kernel DCCP module: an integer overflow in dccp_feat_change within net/dccp/feat.c on kernels 2.6.17–2.6.20 and 2.6.18, enabling a local attacker to trigger a heap-based buffer overflow and gain privileges. Connected advisories reference this issue as pa...

CVE-2008-3527

CVE-2008-3527 affects the Linux kernel (arch/i386/sysenter/vDSO). The vulnerability stems from missing boundary checks in vDSO install_special_mapping, syscall, and syscall32_nopage in the Linux kernel prior to 2.6.21, permitting local users to gain privileges or cause a denial of service. Affect...

CVE-2010-1148

CVE-2010-1148 – Linux kernel vulnerability : The cifs_create function in fs/cifs/dir.c (affected in Linux kernel 2.6.33.2 and earlier) can be triggered by a POSIX file-creation request to a server that supports UNIX extensions when the nd field is a NULL nameidata. This can lead to a NULL pointer...

CVE-2010-2960

CVE-2010-2960 affects Linux kernel 2.6.35.4 and earlier: the keyctl_session_to_parent function assumes a parent session keyring exists, allowing local users to cause a NULL pointer dereference and system crash (denial of service) via a KEYCTL_SESSION_TO_PARENT argument. Root cause pertains to ses...

CVE-2010-4650

The CVE-2010-4650 issue affects the Linux kernel’s fuse_do_ioctl in fs/fuse/file.c, where a buffer overflow could be exploited by a CUSE server to achieve local denial of service or potential other impact. Multiple connected sources confirm a fix in kernel 2.6.37 and note that exploitation requir...

CVE-2013-0309

CVE-2013-0309 affects arch/x86/include/asm/pgtable.h in the Linux kernel prior to 3.6.2 when Transparent Huge Pages are used. The issue: PROT_NONE memory regions are not properly supported, enabling a local user to trigger a denial of service (system crash). The connected Nessus advisories for Un...

CVE-2013-3224

The CVE-2013-3224 issue affects the Linux kernel’s Bluetooth path: bt_sock_recvmsg in net/bluetooth/af_bluetooth.c before 3.9-rc7 does not fully initialize a length variable, enabling local attackers to leak sensitive data from kernel stack memory via crafted recvmsg/recvfrom calls. Impact is inf...

CVE-2013-6376

The CVE-2013-6376 issue affects the Linux kernel’s KVM path: the recalculate_apic_map function in arch/x86/kvm/lapic.c, with impact described as a host-OS crash ( denial of service ) via a crafted ICR write in x2apic mode. The connected Nessus advisories (UNITY_LINUX_UTSA series) reproduce the sa...

CVE-2015-3291

CVE-2015-3291 concerns the Linux kernel before 4.1.6 on the x86_64 platform. The issue is that nested NMI processing is not properly detected, allowing a local attacker to trigger a denial of service (skipped NMI) by manipulating the rsp register, issuing a syscall, and triggering an NMI. Affecte...

CVE-2016-10764

In CVE-2016-10764, the vulnerability is in the Linux kernel before 4.9.6: the cadence-quadspi.c file in drivers/mtd/spi-nor contains an off-by-one error in cqspi_setup_flash() where the f_pdata array uses CQSPI_MAX_CHIPSELECT elements and the comparison should be >= instead of >. This is co...

CVE-2017-12168

CVE-2017-12168 affects the Linux kernel (arch/arm64) in the KVM subsystem, where the access_pmu_evcntr function in arch/arm64/kvm/sys_regs.c allows a privileged KVM guest OS user to trigger a denial of service (assertion failure and host crash) by reading the Performance Monitors Cycle Count Regi...

CVE-2019-3837

CVE-2019-3837 affects the 2.6.32 kernel as shipped in RHEL6. The net_dma code in tcp_recvmsg() is thread-unsafe, so an unprivileged multi-threaded userspace application calling recvmsg() for the same socket in parallel on ioatdma-enabled hardware with net_dma enabled can leak memory, crash the ho...

CVE-2021-47180

The CVE-2021-47180 entry concerns a Linux kernel NFC component memory-leak in nci_allocate_device, with nfcmrvl_disconnect failing to free the hci_dev field and a fix to release hci_dev in nci_free_device. Connected documents (Astra Linux and Nessus-derived advisories) confirm the issue and its r...

CVE-2021-47214

CVE-2021-47214 affects Linux kernel hugetlb/userfaultfd handling. The fix corrects reservation restoration on userfaultfd error in hugetlb_mcopy_atomic_pte() by treating the is_continue path like pagecache insertion and altering the new_pagecache_page flag (renamed to page_in_pagecache) so restor...

CVE-2021-47230

CVE-2021-47230 affects the Linux kernel KVM on x86. The vulnerability arises from a lack of synchronization between the vCPU SMM flag and the MMU’s SMM flag, so that when RSM is not emulated correctly, KVM can bail out and leave the MMU in an inconsistent state. This misalignment can cause a NULL...

CVE-2021-47232

CVE-2021-47232 affects the Linux kernel CAN/J1939 subsystem. The root cause is a Use‑After‑Free caused by taking a skb from the per‑session skb queue without incrementing its refcount, which can occur concurrently due to CTS. The patch fixes this by ensuring skb refcounting is handled correctly w...

CVE-2021-47256

CVE-2021-47256 stems from a Linux kernel memory_failure fix where a missing wait for page writeback could leave inode i_wb_list in an inconsistent state, triggering a BUG_ON in clear_inode and kernel panic. Connected advisories describe the root cause: after end_page_writeback, inode->i_wb_lis...

CVE-2021-47283

CVE-2021-47283 concerns the Linux kernel where the SFC driver could leak IRQ resources when using legacy IRQs. The issue arises because the flag irqs_hooked was not set during initialization in legacy IRQ mode, causing non-freed interrupt descriptors on module removal. The vulnerability affects t...

CVE-2021-47295

CVE-2021-47295 affects the Linux kernel net: sched tcindex code. The issue was a memory leak in tcindex_partial_destroy_work due to the allocation of a new tcindex_data in tcindex_set_parms() and copying fields from the old one without freeing the old tcindex_data’s perfect hash. The destroy func...

CVE-2021-47316

CVE-2021-47316: In the Linux kernel, nfsd: fix NULL dereference in nfs3svc_encode_getaclres where error cases may leave dentry NULL. Affected component is the NFS daemon encoder (nfs3acl.c); root cause is improper handling in the XDR encoder initialization leading to a NULL dereference. The issue...

CVE-2021-47340

CVE-2021-47340 is a Linux kernel vulnerability in the JFS subsystem. The issue arises when diFree() processes an inode without a valid ipimap, causing a NULL dereference via JFS_IP(ipimap) and leading to a GFP-related fault. The fix prevents passing an inode with IPIMAP == NULL to diFree, avoidin...

CVE-2021-47398

The CVE-2021-47398 entry concerns a Linux kernel RDMA/hfi1 pointer leak. The vulnerability stemmed from printing secured pointers using unsigned long long with %llx, which could reveal addresses. The fix changes the formatting to print pointers with %p or %px, eliminating the cast to a large inte...

CVE-2021-47417

CVE-2021-47417 refers to a Linux kernel memory-leak issue in libbpf’s strset management. The vulnerability arises from freeing only internal parts previously, not the strset structure itself, allowing a memory leak. The CVE description and connected advisories confirm this root cause and indicate...

CVE-2021-47420

CVE-2021-47420 affects the Linux kernel in the DRM/AMDKFD path. The issue is a memory leak: memory allocated for ttm->sg by kmalloc in kfd_mem_dmamap_userptr is not freed in kfd_mem_dmaunmap_userptr. The vulnerability has been resolved by freeing the leaked memory. Connected advisories (Astra ...

CVE-2021-47444

CVE-2021-47444 relates to the Linux kernel DRM/EDID handling. The issue stems from connector_bad_edid() assuming the EDID buffer could hold edid[0x7e] + 1 blocks, while ignoring the actual allocated size indicated by num_blocks. A bounds check was added to prevent reading beyond allocated memory,...

CVE-2021-47447

The CVE-2021-47447 issue concerns the Linux kernel DRM MSM A3XX driver: drm/msm/a3xx_gpu_init() contained error paths that returned 1 on failure instead of a negative error code, and a check for ret != -ENODATA failed because ret was 1, risking an Oops in the caller. Astra Linux advisory confirms...

CVE-2021-47448

CVE-2021-47448 affects the Linux kernel’s MPTCP path: recvmsg() with MSG_WAITALL can stall when not enough data is available, leaving mptcp_wait_data() in a state where MPTCP_DATA_READY is set but never cleared, which can trigger an RCU stall. The bug is in the mptcp_recvmsg/mptcp_wait_data path ...

CVE-2021-47503

In CVE-2021-47503, the Linux kernel SCSI pm80xx driver has a fix: do not call scsi_remove_host() inside pm8001_alloc() because scsi_add_host() has not yet been called, which previously could crash with a NULL pointer dereference during device_del. The issue occurs in the pm8001_pci_probe flow lea...