CVE-2025-37965

Concretely described CVE-2025-37965 affects the Linux kernel DRM/AMD display code. The root cause is GFP_KERNEL memory allocations in populate_dml_plane_cfg_from_plane_state(), which are unsafe in atomic contexts. The fix removes dynamic allocations by passing a pointer to scaler_data within the ...

CVE-2025-37977

Technical details for CVE-2025-37977 are not publicly available in the provided connected documents; monitor for updates.

CVE-2025-38053

Summary: A Linux kernel vulnerability (CVE-2025-38053) affects the idpf_features_check path used to validate TX skb features. The root cause is a NULL vport pointer in the netdev private structure after reset, which can lead to a kernel NULL pointer dereference when comparing skb header length wi...

CVE-2025-38105

CVE-2025-38105 concerns the Linux kernel ALSA USB audio path. The issue arises when the USB-audio MIDI driver’s timer is initialized but the driver is freed without an explicit disconnect, potentially leaving an active timer and triggering a kernel warning under debug builds. The documented fix i...

CVE-2025-38108

CVE-2025-38108 affects the Linux kernel’s network scheduler, specifically the RED qdisc. The issue is a race in __red_change() where the SFQ perturb timer can fire at an inopportune time, allowing an underflow of a parent qlen during a concurrent qdisc_tree_flush/backlog sequence. The race scenar...

CVE-2025-38126

CVE-2025-38126 affects the Linux kernel’s stmmac driver in timestamp configuration. The root cause is that clk_ptp_rate can become 0 (if clk_get_rate returns 0 and the driver does not override it), leading to a division by zero during PTP initialization. The issue is fixed by adding an explicit c...

CVE-2025-38131

CVE-2025-38131 affects the Linux kernel coresight subsystem. The issue arises when enabling an active config via cscfg_csdev_enable_active_config() but the config could be deactivated via configfs/sysfs during unloading, potentially leading to use-after-free of config_desc after the module unload...

CVE-2025-38153

CVE-2025-38153 (Linux kernel) is documented in connected sources as a vulnerability in the aqc111 USB network driver. The issue arises from incomplete sanitation of usbnet read results, where usbnet_read_cmd() may return fewer bytes than expected and aqc111_read_cmd() may not validate the result,...

CVE-2025-38157

Affected software: Linux kernel driver ath9k_htc (wifi). Issue: when an adversarial USB device emits WMI_SWBA_EVENTID before beaconing is enabled, ath9k_htc_swba() may trigger a device-by-zero error causing a crash or out-of-bounds read. Root cause: improper handling of software beacon processing...

CVE-2025-38160

CVE-2025-38160 affects the Linux kernel due to a NULL pointer dereference in the Raspberry Pi clock registration path. Specifically, raspberrypi_clk_register() does not handle a NULL return from devm_kasprintf(), which can occur if memory allocation fails. A fix has added a NULL check after devm_...

CVE-2025-38162

CVE-2025-38162 affects the Linux kernel netfilter nft_set_pipapo implementation. The vulnerability arises from potential overflow during lookup table size calculation in the set handling path. The description specifies that the calculation must guard against overflow across multiple factors: desc...

CVE-2025-38210

CVE-2025-38210 concerns the Linux kernel in the configfs-tsm-report path. The root cause is a NULL-dereference risk when tsm_ops have been unregistered but certain code paths (tsm_report_privlevel_store(), tsm_report_provider_show()) did not verify the removal, leading to potential config-item ac...

CVE-2025-38222

Summary : CVE-2025-38222 refers to a Linux kernel vulnerability in ext4 inline data handling. When inline_data is enabled, a length parameter (len) is incorrectly treated as an unsigned int, causing a truncation of pos+len in ext4_prepare_inline_data. This leads to an incorrect len being passed t...

CVE-2025-38244

The CVE-2025-38244 issue affects the Linux kernel’s SMB client, specifically the CIFS deadlock when reconnecting channels. The vulnerability stems from incorrect lock ordering in cifs_signal_cifsd_for_reconnect(), which could create a circular locking dependency among tcp_ses->srv_lock, ret_bu...

CVE-2025-38263

The CVE-2025-38263 issue in the Linux kernel affects the bcache subsystem, specifically a NULL pointer dereference in cache_set_flush() that could occur during error handling in register_cache_set()/bch_cache_set_alloc(). The crash path can lead to kernel oops and a NULL dereference when cache se...

CVE-2025-38312

CVE-2025-38312 concerns the Linux kernel fbdev path: fbcvt. In fb_find_mode_cvt(), if mode->refresh equals 0x80000000, cvt.f_refresh overflows when doubled, and is subsequently used as a divider in fb_cvt_hperiod(), causing a division by zero and potential kernel oops. The vulnerability is res...

CVE-2025-38326

CVE-2025-38326: Linux kernel AOE driver vulnerability where aoe device rq_list isn’t cleaned on down, causing blk_mq_freeze_queue() to sleep and hang. Fix clears the rq_list before blk_mq_freeze_queue(). No exploitation details provided; remediation is the kernel fix.

CVE-2025-38391

CVE-2025-38391 in the Linux kernel addresses a vulnerability in USB Type-C Alt Mode handling for DisplayPort. A misbehaving port partner could claim pin assignment capabilities beyond the valid range, causing an out-of-bounds access in pin_assignment_show. The fix adds a DP_PIN_ASSIGN_MAX constan...

CVE-2025-38409

CVE-2025-38409 affects the Linux kernel, specifically the drm/msm path. The issue is a leak in the submit error path where put_unused_fd() fails to free the installed file if fd_install() has already occurred, leading to a leaked resource (sync_file). The patch fixes the leak by freeing the sync_...

CVE-2025-38416

Mode C: CVE-2025-38416 affects the Linux kernel NFC: nci: uart path. The vulnerability arises from setting tty->disc_data before the NCI device open/driver request succeeds, creating a small window where the device may start sending data and leaving state inconsistent on error paths. The fix e...

CVE-2025-38417

The CVE-2025-38417 issue affects the Linux kernel ice/eswitch path where memory for VF port representors could be allocated during reset and not freed in legacy (non-switchdev) mode. The fix adds a mode check to allocate required port memory only in switchdev mode and prevents blindly allocating ...

CVE-2025-38427

Summary: CVE-2025-38427 in the Linux kernel fixes a framebuffer relocation bug where screen_info frames were tied to boot CPU addresses, not accounting for PCI host-bridge offsets. During boot, firmware may assign a different PCI memory offset, relocating PCI graphics framebuffer addresses. The k...

CVE-2025-38462

CVE-2025-38462 affects the Linux kernel vsock subsystem. Root cause is a TOCTOU race in vsock_find_cid() and vsock_dev_do_ioctl() with module unload, where transport_g2h/h2g can become NULL after a NULL check, causing null-pointer derefs. The patch adds vsock_transport_local_cid() to guard agains...

CVE-2025-38470

CVE-2025-38470 affects the Linux kernel VLAN handling when 8021q rx-vlan-filter is enabled. It can cause VLAN 0 to be emulated on NETDEV_UP/DC_DOWN, leading to a memory leak if VLAN 0 is not removed, or a potential null-vlan_info path triggering a BUG_ON during device teardown. Root cause: refcnt...

CVE-2025-38555

The CVE CVE-2025-38555 is a use-after-free in Linux kernel USB gadget driver during composite_dev_cleanup, arising when configfs_composite_bind() frees cdev->os_desc_req on kmalloc failure but doesn’t NULL it, leading to a subsequent use of non-NULL pointer. The issue affects the usb gadget’s ...

CVE-2026-31694

Summary: CVE-2026-31694 fixes a Linux kernel FUSE directory-entry handling flaw. A malicious FUSE server could cause a 24-byte overflow by returning a dirent whose serialized size (based on namelen) exceeds a single PAGE_SIZE. The bug arises in fuse_add_dirent_to_cache(), which previously only ch...

CVE-2026-43341

The CVE-2026-43341 details Linux kernel IOAM6 trace filling vulnerability. In ioam6_fill_trace_data(), the schema length is accumulated in an 8-bit unsigned variable (sclen). With the largest schema payload and bit 22 set, sclen wraps from 256 to 0 (1 + 1020/4), bypassing the remaining-space chec...

CVE-2001-0317

The CVE covers a race condition in Linux kernel ptrace handling that lets an unprivileged local user attach to and modify a running setuid process to gain root. Affected: Linux kernel 2.2.x and 2.4.x (ptrace/procfs/execve paths cited). Root cause: race in ptrace usage during privileged operations...

CVE-2004-0003

Technical details for CVE-2004-0003 are not publicly available in the provided documents. No concrete description of affected component, root cause, or remediation is present; monitor for updates from the sources.

CVE-2005-3660

CVE-2005-3660 affects the Linux kernel 2.4.x and 2.6.x. The vulnerability occurs when a process creates a large number of connected file descriptors or socketpairs and uses a large data transfer buffer, which can exhaust memory and cause a kernel panic or denial of service. The underlying issue c...

CVE-2007-6761

CVE-2007-6761 affects the Linux kernel up to version 2.6.23/24 era: the videobuf-vmalloc.c path (drivers/media/video) contains uninitialized videobuf_mapping data structures. This can allow a local attacker to trigger an incorrect memory-management state and a videobuf leak via unspecified vector...

CVE-2008-2365

CVE-2008-2365 describes a race condition in Linux kernel ptrace/utrace support (kernel 2.6.9–2.6.25) used by RHEL4. A local user can cause a denial of service (oops) by issuing a long sequence of PTRACE_ATTACH calls that trigger a conflict between utrace_detach and report_quiescent due to a late ...

CVE-2009-0746

The CVE-2009-0746 entry concerns the Linux kernel ext4 code: make_indexed_dir in fs/ext4/namei.c fails to validate a rec_len field, allowing a local attacker to trigger a denial of service (OOPS) by mounting a crafted ext4 filesystem. Affected is kernel 2.6.27 up to 2.6.27.19 and 2.6.28 up to 2.6...

CVE-2009-2846

CVE-2009-2846 affects the eisa_eeprom_read function in the parisc isa-eeprom driver (drivers/parisc/eisa_eeprom.c) of the Linux kernel prior to 2.6.31-rc6. A negative ppos argument bypasses a positive-ppos check, leading to an out-of-bounds read in readb and allowing local users to access restric...

CVE-2009-3556

The CVE-2009-3556 issue is confirmed in multiple connected sources: a Red Hat qla2xxx NPIV-related configuration step in the Linux kernel (2.6.18 on RHEL5) leaves /sys/class/scsi_host/vport_create and /sys/class/scsi_host/vport_delete world-writable, enabling local users to alter SCSI host attrib...

CVE-2009-3638

CVE-2009-3638 affects the Linux kernel KVM subsystem: integer overflow in kvm_dev_ioctl_get_supported_cpuid (arch/x86/kvm/x86.c) allows local users to trigger an unspecified impact via KVM_GET_SUPPORTED_CPUID requests. Affected versions are Linux kernels before 2.6.31.4. Remediation is to upgrade...

CVE-2010-1436

CVE-2010-1436 involves the Linux kernel 2.6.18 (and possibly other versions) where the gfs2_quota struct can span two pages, leading to an out-of-bounds write and a local denial of service (kernel panic) when manipulating gfs2 and ext3 file systems. The MiracleLinux AXSA-2010-377:12 advisory list...

CVE-2011-1476

CVE-2011-1476 is an integer underflow in the Linux kernel OSS subsystem (specifically the MIDI/OSS sequencer driver) before 2.6.39 on unspecified non-x86 platforms. It allows local users to cause a denial of service via memory corruption by crafting writes to /dev/sequencer. Publicly documented f...

CVE-2011-2898

CVE-2011-2898 concerns the Linux kernel AF_PACKET implementation. The flaw allows local users to read potentially sensitive kernel memory by exploiting inadequate restrictions on VLAN Tag Control Information data structures. The vulnerability is described as a kernel information leak in the AF_PA...

CVE-2012-2384

CVE-2012-2384 : Integer overflow in i915_gem_do_execbuffer (drivers/gpu/drm/i915/i915_gem_execbuffer.c) of the Linux kernel before 3.3.5 on 32-bit platforms. Local users may trigger an out-of-bounds write via a crafted ioctl, causing denial of service (and possibly other impact). Affected: DRM/i9...

CVE-2012-6540

CVE-2012-6540 affects the Linux kernel prior to 3.6: do_ip_vs_get_ctl in net/netfilter/ipvs/ip_vs_ctl.c does not initialize a structure for IP_VS_SO_GET_TIMEOUT, enabling local users to read sensitive data from kernel stack memory via a crafted application. Advised fix is upgrading to a kernel wi...

CVE-2014-5045

CVE-2014-5045 – Linux kernel mountpoint_last bug (pre-3.15.8) Affected: Linux kernel versions prior to 3.15.8.Root cause: The mountpoint_last function in fs/namei.c does not properly maintain a reference count when unmount is used in conjunction with a symlink.Impact: Local users could cause deni...

CVE-2015-0572

The CVE-2015-0572 entry concerns the ADSPRPC driver for the Linux kernel (drivers/char/adsprpc.c and drivers/char/adsprpc_compat.c) used in Qualcomm QuIC MSM Android contributions and other devices. The issue is a race condition that can be exploited via the COMPAT_FASTRPC_IOCTL_INVOKE_FD ioctl, ...

CVE-2015-2672

The CVE-2015-2672 entry concerns the Linux kernel’s xsave/xrstor implementation (arch/x86/include/asm/xsave.h). Vulnerable code paths exist in kernels before 3.19.2 where certain .altinstr_replacement pointers are created, failing to provide protection against instruction faulting. Local attacker...

CVE-2016-2066

CVE-2016-2066 affects the MSM QDSP6 audio driver in the Linux kernel 3.x as used in Qualcomm QuIC Android contributions for MSM devices and related products. The issue is an integer signedness error in the msm-audio-effects-q6-v2.c path that handles ioctl commands, leading to memory corruption. P...

CVE-2016-9777

KVM in the Linux kernel (before 4.8.12) is vulnerable when I/O APIC is enabled. A guest user can craft an interrupt request to bypass VCPU index restrictions, potentially gaining host privileges or causing a host denial of service via out-of-bounds access and host crash. Affected components: arch...

CVE-2017-0525

CVE-2017-0525 is an elevation-of-privilege issue in the Qualcomm IPA driver on Android, enabling a local attacker to execute code in kernel context. Affected: Android devices using Kernel-3.10 or Kernel-3.18 with the Qualcomm IPA driver. Impact per sources: local privilege escalation requiring pr...

CVE-2017-18552

CVE-2017-18552 affects the Linux kernel up to version 4.10 in net/rds/af_rds.c, where rds_recv_track_latency contains an out-of-bounds write and read. The connected Nessus advisories (Unity Linux UTSA advisories) mirror this issue and reference kernel versions before 4.11, with a commit in the Li...

CVE-2021-47218

CVE-2021-47218: Linux kernel SELinux hashtab allocation failure could lead to NULL dereference. Root cause: on hashtab_init() allocation failure, h->size remains non-zero while h->htable is NULL, breaking hashtab_map() and hashtab_destroy() which assume non-empty hashtab. Mitigation in the ...

CVE-2021-47232

CVE-2021-47232 affects the Linux kernel CAN/J1939 subsystem. The root cause is a Use‑After‑Free caused by taking a skb from the per‑session skb queue without incrementing its refcount, which can occur concurrently due to CTS. The patch fixes this by ensuring skb refcounting is handled correctly w...