CVE-2005-3272

CVE-2005-3272 affects the Linux kernel prior to 2.6.12. The issue lets remote attackers poison the bridge forwarding table with frames that have already been dropped by filtering, causing the bridge to forward spoofed packets. The vulnerability stems from how bridge/frame filtering handling inter...

CVE-2006-1527

CVE-2006-1527 affects the SCTP-netfilter code in the Linux kernel; an invalid SCTP chunk size can cause for_each_sctp_chunk to loop indefinitely, enabling a remote attacker to trigger a denial of service. The issue is in kernels prior to 2.6.16.13 and is addressed by the upstream 2.6.16.13 patch....

CVE-2006-2451

The CVE-2006-2451 issue affects Linux kernel 2.6.13 up to 2.6.17.4 inclusive, and 2.6.16 up to 2.6.16.24, where the suid_dumpable handling enables a local user to cause disk-based denial of service and potentially gain privileges via PR_SET_DUMPABLE when a core dump is created in a directory the ...

CVE-2006-5751

CVE-2006-5751 concerns the Linux kernel (pre-2.6.18.4) where an integer overflow in get_fdb_entries (net/bridge/br_ioctl.c) allows a local user to trigger arbitrary code execution by supplying a large maxnum in an ioctl. The issue is rooted in kernel networking bridge ioctl handling and could ena...

CVE-2006-6054

The CVE-2006-6054 issue affects the Linux kernel 2.6.x ext2 file system code, where a malformed ext2 stream can cause ext2_check_page to crash due to a length smaller than the minimum, enabling a local denial of service. Several connected advisories indicate this flaw was fixed in kernel updates ...

CVE-2007-6716

CVE-2007-6716 affects the Linux kernel before 2.6.23, where in the dio subsystem the file system’s direct-io path (fs/direct-io.c) may fail to zero out the dio struct. This can allow a local user to cause a denial of service (OOPS), as demonstrated by a fio test. The connected documents confirm t...

CVE-2008-0010

CVE-2008-0010 concerns the Linux kernel vulnerability in copy_from_user_mmap_sem (fs/splice.c) affecting kernels 2.6.22 through 2.6.24. The root cause is a failure to validate a userspace pointer before dereferencing, which allows a local attacker to read from arbitrary kernel memory locations. A...

CVE-2009-2767

CVE-2009-2767 affects the Linux kernel up to version 2.6.31-rc6. The init_posix_timers function in kernel/posix-timers.c mishandles CLOCK_MONOTONIC_RAW clock_nanosleep, triggering a NULL pointer dereference and enabling local users to cause a denial of service (OOPS) or potentially gain privilege...

CVE-2013-2128

The CVE-2013-2128 issue affects the Linux kernel’s tcp_read_sock() in net/ipv4/tcp.c where skb consumption is not properly managed. This can allow local attackers to trigger a denial of service (system crash) by issuing a crafted splice() on a TCP socket. Evidence appears across multiple advisori...

CVE-2013-7027

The CVE-2013-7027 entry concerns the Linux kernel vulnerability in the ieee80211_radiotap_iterator_init function (net/wireless/radiotap.c) prior to 3.11.7. The issue is that the code does not validate whether a frame contains data outside of the header, which may allow an attacker to trigger a de...

CVE-2015-7885

CVE-2015-7885 affects the Linux kernel: the dgnc_mgmt_ioctl function in drivers/staging/dgnc/dgnc_mgmt.c does not initialize a certain structure member, enabling a local attacker to read sensitive kernel memory via a crafted application. The issue is scoped to kernels up to version 4.3.3. Connect...

CVE-2015-8950

CVE-2015-8950 affects the Linux kernel (arch/arm64/mm/dma-mapping.c) prior to 4.0.3, where uninitialized data structures in the ION memory-management path can be exposed via dma_mmap. This local-access vulnerability could allow a non-privileged user to read kernel memory. The public references in...

CVE-2016-2064

The CVE-2016-2064 entry concerns the MSM QDSP6 audio driver (Linux kernel 3.x) in sound/soc/msm/qdsp6v2/msm-audio-effects-q6-v2.c, used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices. The vulnerability arises from an ioctl handling flaw that allows a crafted applicatio...

CVE-2016-9755

CVE-2016-9755 affects the Linux kernel netfilter IPv6 reassembly logic prior to 4.9. It allows local users to cause a denial of service via a crafted application that uses socket, connect, and writev calls, due to an integer overflow / out-of-bounds write in the IPv6 reassembly path. The root cau...

CVE-2017-0537

CVE-2017-0537 affects Android kernels with Kernel-3.18 and relates to the USB gadget driver. It enables a local attacker to disclose data outside their permissions after compromising a privileged process. Impact: partial confidentiality. No public fixes or remediation details are provided in the ...

CVE-2017-15306

The CVE-2017-15306 entry concerns the Linux kernel (PowerPC) KVM. The vulnerable component is arch/powerpc/kvm/powerpc.c, specifically the kvm_vm_ioctl_check_extension function. The issue arises when handling the KVM_CHECK_EXTENSION KVM_CAP_PPC_HTM ioctl on /dev/kvm, allowing a local attacker to ...

CVE-2017-18549

CVE-2017-18549 affects the Linux kernel component drivers/scsi/aacraid/commctrl.c in versions prior to 4.13. The root cause is that aac_send_raw_srb does not initialize the reply structure, which can lead to exposure of kernel stack memory. The connected Nessus entries (Unity Linux advisories) re...

CVE-2018-12633

CVE-2018-12633 affects the Linux kernel up to 4.17.2, where vbg_misc_device_ioctl() in drivers/virt/vboxguest/vboxguest_linux.c double-fetches header data from user input via copy_from_user. A race condition lets a local attacker tamper with hdr.size_in and hdr.size_out between fetches, enabling ...

CVE-2020-25221

CVE-2020-25221 affects Linux kernel 5.7.x and 5.8.x before 5.8.7. The vulnerability arises in get_gate_page() implemented in mm/gup.c, due to incorrect reference counting of the backing struct page for the vsyscall page, causing a refcount underflow. It can be triggered by any 64-bit process that...

CVE-2021-4218

CVE-2021-4218 concerns a flaw in the Linux kernel related to reading the SVC RDMA counters. The vulnerability occurs when a local attacker with access triggers reading the counter via a sysctl, which panics the system and can cause a denial of service during reboot. The issue is described as spec...

CVE-2021-47150

CVE-2021-47150 is a Linux kernel issue in the network driver fec/enet: the fix addresses a potential memory leak in fec_enet_init(). When cbd_base allocation fails, memory allocated for the queues must be freed; otherwise a leak occurs. If allocation for the queues fails, the function now returns...

CVE-2021-47180

The CVE-2021-47180 entry concerns a Linux kernel NFC component memory-leak in nci_allocate_device, with nfcmrvl_disconnect failing to free the hci_dev field and a fix to release hci_dev in nci_free_device. Connected documents (Astra Linux and Nessus-derived advisories) confirm the issue and its r...

CVE-2021-47196

CVE-2021-47196 concerns a use-after-free in the Linux kernel mlx5_ib path during QP creation. The issue arises when RDMA/core code presets both receive and send completion queue pointers before forwarding to the driver, then overwrites ibqp properties and continues into the driver path. If mlx5_q...

CVE-2021-47204

CVE-2021-47204 affects the Linux kernel’s net: dpaa2-eth driver. The flaw is a use-after-free in dpaa2_eth_remove where access to a freed netdev occurs. The fix moves the debug log to occur before free_netdev(), preventing use-after-free. Public descriptions in connected advisories (AstraLinux, U...

CVE-2021-47283

CVE-2021-47283 concerns the Linux kernel where the SFC driver could leak IRQ resources when using legacy IRQs. The issue arises because the flag irqs_hooked was not set during initialization in legacy IRQ mode, causing non-freed interrupt descriptors on module removal. The vulnerability affects t...

CVE-2021-47290

CVE-2021-47290 affects the Linux kernel SCSI target path (XCOPY completion) where a NULL pointer dereference could occur due to an NULL se_tpg_wwn pointer in the extended copy workflow. The root cause is that LIO’s EXTENDED COPY worker dispatches reads/writes via a global xcopy_pt_tpg, which may ...

CVE-2021-47294

The CVE-2021-47294 issue affects the Linux kernel NETROM implementation where sock timer handling changed to sock timer API. sk_reset_timer() may increase the sock refcount when called on an inactive timer, so if the timer expires the handler must decrease the refcount to avoid a leak. A patch (c...

CVE-2021-47295

A memory leak vulnerability exists in the Linux kernel 's network scheduling subsystem, specifically within the tcindex_partial_destroy_work function. The issue was triggered by tcindex_set_parms() , where new tcindex_data was allocated but the perfect hash was not properly freed during destructi...

CVE-2021-47364

Summary (CVE-2021-47364) The Linux kernel vulnerability in the comedi subsystem affects the 32-bit version of the COMEDI_INSNLIST ioctl when CONFIG_COMPAT is enabled. The issue is a memory leak in compat_insnlist(): memory was allocated to hold a converted array of struct comedi_insn and only fre...

CVE-2021-47398

The CVE-2021-47398 entry concerns a Linux kernel RDMA/hfi1 pointer leak. The vulnerability stemmed from printing secured pointers using unsigned long long with %llx, which could reveal addresses. The fix changes the formatting to print pointers with %p or %px, eliminating the cast to a large inte...

CVE-2021-47440

A null pointer dereference vulnerability exists in the Linux kernel within the encx24j600 component. The issue is caused by the devm_regmap_init_encx24j600 function failing to check for errors returned by devm_regmap_init , which can occur during scenarios such as out-of-memory conditions. This l...

CVE-2021-47512

The CVE-2021-47512 issue affects the Linux kernel’s net/sched fq_pie/Qdisc handling. fq_pie_destroy() failed to copy logic from pie_destroy() and related qdiscs, risking a timer rearm during del_timer_sync(&q->adapt_timer) and potentially triggering an rcu stall or related instability. The pro...

CVE-2021-47529

CVE-2021-47529: Linux kernel vulnerability in iwlwifi memory management where memory allocated in reduce_power_data could leak on error (invalid TLV len or memory allocation failure). The issue has been fixed in the Linux kernel by freeing allocated memory in the error path before return. Connect...

CVE-2021-47578

CVE-2021-47578 impacts the Linux kernel. The vulnerability stems from the scsi_debug path calling memory allocation with a zero size: if size == 0, kcalloc() returns ZERO_SIZE_PTR, which can break a following NULL-pointer check. The fix is to return early (do not call kcalloc()) when the size arg...

CVE-2021-47668

CVE-2021-47668 is a Linux kernel use-after-free vulnerability in the CAN restart path. The issue occurs when, after calling netif_rx_ni(skb), the code dereferences the same skb memory (specifically cf->len from the can_frame cf aliasing skb), which is unsafe and can lead to memory corruption. ...

CVE-2022-48650

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix memory leak in __qlt_24xx_handle_abts() Commit 8f394da36a36 ("scsi: qla2xxx: Drop TARGET_SCF_LOOKUP_LUN_FROM_TAG")made the __qlt_24xx_handle_abts() function return early iftcm_qla2xxx_find_cmd_by_tag() didn't f...

CVE-2022-48654

The CVE-2022-48654 issue affects the Linux kernel netfilter nfnetlink_osf component, where nf_osf_find() could incorrectly return true on a mismatch. This causes copying of an uninitialized memory area in nft_osf, potentially leaking stale kernel stack data to userspace. The connected advisories ...

CVE-2022-48691

CVE-2022-48691 is a Linux kernel vulnerability affecting nf_tables offload hook handling. The issue arises from clean up of the hook list when offload flag checks fail, enabling a memory leak of an unreferenced object and preventing nft_chain_release_hook() from freeing hooks. The connected Nessu...

CVE-2022-48692

The CVE-2022-48692 issue affects the Linux kernel RDMA/srp path. A NULL dereference was mitigated by changing the code to set scmnd->result only when scmnd is not NULL, addressing a kernel NULL pointer dereference that could be reproduced by blktests srp/007. Connected advisories (Astra Linux,...

CVE-2022-48725

CVE-2022-48725: Linux kernel RDMA/siw: fix refcounting leak in siw_create_qp by ensuring atomic_inc() is paired with atomic_dec() on the error path. The issue allows a leak on error handling during QP creation; remediation is a kernel patch (e.g., commits listed in the references) that corrects t...

CVE-2022-48769

In CVE-2022-48769, the Linux kernel vulnerability concerns Apple x86 EFI runtime services. The issue stems from a call to QueryVariableInfo() (added with EFI 2.00) used at runtime, which could crash firmware on certain Apple machines when managing NVRAM variables. The mitigation described is to a...

CVE-2022-48844

The CVE-2022-48844 entry refers to a Linux kernel Bluetooth issue in the hci_core subsystem: sent_cmd memory is leaked when freeing hci_dev, causing a memory leak. This is a local, low-privilege exposure with high availability impact as per the CVSS data. Connected advisories confirm a fixed fix ...

CVE-2022-48909

The CVE-2022-48909 entry relates to the Linux kernel net/smc subsystem. A connection leak could occur during a sequence where, after initiating a close, a tcp_abort() may discard pending CLC CONFIRM messages in the TCP send buffer, preventing delivery of the connection token and blocking passive ...

CVE-2022-48928

The CVE-2022-48928 issue affects the Linux kernel driver iio: adc, specifically the men_z188_adc component. A resource leak occurs in an error path when iio_device_register() fails, leaving a previously mapped region (ioremap()) unbalanced. The root cause is an unbalanced iounmap() not being call...

CVE-2022-49169

CVE-2022-49169 concerns the Linux kernel’s f2fs module and a race/lock issue that could cause a hang. The connected advisories document that the fix is to replace a mutex-based path with a spin_lock, specifically to avoid hang scenarios in f2fs when handling certain task reads and statistics oper...

CVE-2022-49254

CVE-2022-49254 concerns the Linux kernel media TI-VPE driver. In cal_ctx_v4l2_init_formats(), the code assigns the result of devm_kzalloc() to ctx->active_fmt and then dereferences it unconditionally, which could cause a NULL pointer dereference if allocation fails. The vulnerability is mitiga...

CVE-2022-49369

CVE-2022-49369 concerns a memory leak in the Linux kernel’s amt_rcv() path: when an amt packet is received and no matching socket is found, the received skb is not freed, potentially leaking memory. The issue is described as resolved in the kernel; connected docs reference patches addressing the ...

CVE-2022-49485

CVE-2022-49485 describes a Linux kernel issue in drm/v3d: a null pointer dereference of pointer perfmon where WARN_ON happens after the pointer has been dereferenced. The fix is to dereference perfmon only after it has been null-checked. Affected component: Linux kernel (drm/v3d path). Impact, pe...

CVE-2022-49488

In CVE-2022-49488, the Linux kernel subsystem drm/msm/mdp5 is affected. The root cause is that mdp5_get_global_state could return the error -EDEADLK while acquiring the modeset lock, but mdp5_mixer_release did not propagate this error, risking a NULL dereference. The mitigation is a patch to have...

CVE-2022-49560

Summary: CVE-2022-49560 affects the Linux kernel exfat code. A slab-out-of-bounds read in exfat_clear_bitmap was triggered by truncating to size 0, reported by Syzbot. Root cause/fix in connected docs: the patch moves the is_valid_cluster() helper from fatent.c to a common header to allow reuse, ...