CVE-2019-19332

CVE-2019-19332 affects the Linux kernel KVM implementation (x86) with an out-of-bounds memory write in handling the KVM_GET_EMULATED_CPUID ioctl, enabling a local user with access to /dev/kvm to crash the system (DoS). Affected range is kernels 3.13–5.4. Root cause described as a missing/bounds-c...

CVE-2020-24394

CVE-2020-24394 affects the Linux kernel before 5.7.8 in the NFS server (fs/nfsd/vfs.c). The root cause is that ACL-less filesystems do not apply the current umask when creating new objects, allowing an attacker with local access to set incorrect permissions. Public details in connected advisories...

CVE-2021-3489

CVE-2021-3489 concerns the Linux kernel eBPF RINGBUF: the bpf_ringbuf_reserve() function could allocate a size larger than the ringbuf, enabling out-of-bounds writes and potential arbitrary code execution. The issue was fixed by commit 4b81ccebaeee ("bpf, ringbuf: Deny reserve of buffers larger t...

CVE-2023-52448

CVE-2023-52448 affects the Linux kernel gfs2 subsystem. Syzkaller reported a NULL pointer dereference in gfs2_rgrp_dump when rgd->rd_rgl is accessed, potentially after rgd->rd_gl creation fails in read_rindex_entry(). The fix adds a NULL pointer check in gfs2_rgrp_dump() to prevent derefere...

CVE-2019-15030

CVE-2019-15030 affects the Linux kernel on powerpc up to 5.2.14. A local user can read another local process’s vector registers by exploiting a Facility Unavailable exception when starting a transaction (tbegin) and then accessing vector registers; at some point, vector registers may be corrupted...

CVE-2019-15217

The CVE-2019-15217 entry concerns a NULL pointer dereference in the Linux kernel before 5.2.3, triggered by a malicious USB device via the zr364xx USB driver (drivers/media/usb/zr364xx/zr364xx.c). The issue can lead to a denial of service on a physical USB attack vector. Public references indicat...

CVE-2020-25643

CVE-2020-25643 affects the Linux kernel HDLC_PPP module via improper input validation in ppp_cp_parse_cr, causing memory corruption and a read overflow that can lead to system crash or DoS. Public advisories confirm this vulnerability and reference the same root cause, with mitigations proposed a...

CVE-2020-36311

CVE-2020-36311 affects the Linux kernel prior to 5.9. In arch/x86/kvm/svm/sev.c, destroying a large SEV VM (unregistering many encrypted regions) can trigger a denial of service (soft lockup). The connected advisories confirm the issue and point to a fix in kernel 5.9 (and changelog indicating th...

CVE-2020-26541

CVE-2020-26541 : Local attacker can bypass the Secure Boot Forbidden Signature Database (dbx) protection in Linux kernels up to 5.8.13, affecting certs/blacklist.c and certs/system_keyring.c. Impact involves potential system integrity/confidentiality compromise. Connected sources confirm the issu...

CVE-2023-2163

Summary of CVE-2023-2163 : The issue is an incorrect verifier pruning in the kernel’s BPF verifier for Linux kernel versions >= 5.4, where unsafe code paths can be marked safe, enabling arbitrary reads/writes in kernel memory, lateral privilege escalation, and container escapes. Connected advi...

CVE-2026-46243

The CVE-2026-46243 entry concerns the Linux kernel CIFS client. It fixes a bug where cifs.spnego key descriptions could be created by userspace (via request_key(2) or add_key(2)) and include fields (pid, uid, creduid, upcall_target) that are treated as kernel-origin inputs. The fix restricts acce...

CVE-2019-19462

CVE-2019-19462 affects Linux kernel: relay_open in kernel/relay.c, vulnerable through kernel version 5.4.1, allows local attackers to cause a denial of service (e.g., relay blockage) by triggering a NULL alloc_percpu result. The connected UNITY_LINUX advisories reproduce this description and refe...

CVE-2021-28660

CVE-2021-28660 affects the Realtek RTL8188EU WiFi driver (drivers/staging/rtl8188eu/os_dep/ioctl_linux.c) in the Linux kernel and is caused by writing beyond the end of the ssid[] array in rtw_wx_set_scan. The Connected documents confirm this exact issue across multiple advisories (e.g., Debian L...

CVE-2020-25212

CVE-2020-25212 affects the NFSv4 client in the Linux kernel and is caused by a TOCTOU mismatch where a size check is performed in fs/nfs/nfs4proc.c instead of fs/nfs/nfs4xdr.c. This can allow a local attacker to corrupt memory or cause unspecified impacts. The issue is addressed in the upstream k...

CVE-2021-43976

CVE-2021-43976 affects the Linux kernel, specifically the Marvell mwifiex_usb_recv() function in drivers/net/wireless/marvell/mwifiex/usb.c. A local attacker with access to a crafted USB device can trigger a denial of service (skb_over_panic). The advisory notes the vulnerability exists in kernel...

CVE-2018-21008

CVE-2018-21008 affects the Linux kernel up to version 4.16.6, with a use-after-free in rsi_mac80211_detach (drivers/net/wireless/rsi/rsi_91x_mac80211.c). Nessus/nvd-derived docs consistently reference this flaw across Unity Linux advisories and related feeds, confirming the vulnerable component a...

CVE-2020-8834

Affected software: Linux kernel KVM for PowerPC (KVM with Book3S HV on Power8). Vulnerability arises from conflicting use of HSTATE_HOST_R1 to store r1 state in kvmppc_hv_entry and in kvmppc_save_tm()/kvmppc_restore_tm, leading to stack corruption. Consequence: a guest VM kernel-space code execut...

CVE-2023-31436

Summary: CVE-2023-31436 affects the Linux kernel net/sched/qfq subsystem (qfq_change_class in net/sched/sch_qfq.c). The flaw allows a heap/out-of-bounds write because lmax can exceed QFQ_MIN_LMAX, leading to information disclosure, privilege escalation, or denial of service as described in public...

CVE-2019-9213

CVE-2019-9213 : Linux kernel mmap minimum address check in mm/mmap.c is insufficient, enabling a NULL pointer dereference exploit on platforms without SMAP/PAN. Affected: kernels before 4.20.14. Mitigation: upgrade to 4.20.14 or later (see ChangeLog-4.20.14; USN-3931-2).

CVE-2019-12382

CVE-2019-12382 affects Linux kernels up to 5.1.5 in drm_load_edid_firmware (drm_edid_load.c). There is an unchecked kstrdup of fwstr, which could lead to a denial of service via a NULL pointer dereference and system crash. The description notes the vendor disputes this as a vulnerability because ...

CVE-2021-3656

CVE-2021-3656 describes a flaw in the KVM hypervisor for AMD processors where the L1 guest can provide a VMCB with an improperly validated virt_ext field, allowing the L1 to disable VMLOAD/VMSAVE intercepts and VLS for the L2 guest. This enables the L2 guest to read/write portions of the host’s p...

CVE-2022-28388

CVE-2022-28388 affects the Linux kernel driver usb_8dev_start_xmit (drivers/net/can/usb/usb_8dev.c). The vulnerability is a double free in the function usb_8dev_start_xmit, present up to kernel versions including 5.17.1. Documents reference a commit addressing the issue and mention downstream adv...

CVE-2020-8428

CVE-2020-8428 refers to a use-after-free in the Linux kernel’s VFS layer (fs/namei.c/vfs core) that can be exploited by a local attacker to cause a denial of service or potentially read kernel memory. Public advisories (Debian DSA-4667/DSA-4667-1) attribute the issue to a may_create_in_sticky use...

CVE-2021-3573

CVE-2021-3573 is a local-use-after-free vulnerability in the Linux kernel Bluetooth HCI subsystem (function hci_sock_bound_ioctl) where a race between ioct HCIUNBLOCKADDR and hci_unregister_dev() and calls such as hci_sock_blacklist_add()/del(), hci_get_conn_info(), and hci_get_auth_info() can le...

CVE-2022-3028

CVE-2022-3028 describes a race condition in the Linux kernel’s IP framework (XFRM) where concurrent calls to xfrm_probe_algs can cause an out-of-bounds read that may be copied into a socket, or an out-of-bounds write, enabling a local attacker to leak kernel memory or crash the kernel. Connected ...

CVE-2020-14381

CVE-2020-14381 is a vulnerability in the Linux kernel futex implementation. A local attacker can corrupt memory or escalate privileges when creating a futex on a filesystem that is about to be unmounted. The issue is local, with attack vector and conditions described as exploitation requiring loc...

CVE-2021-20322

CVE-2021-20322 relates to a Linux kernel ICMP handling flaw (ICMP fragment needed/redirect) that lets an off-path attacker quickly discover UDP port usage, bypassing UDP source port randomization. The connected advisories confirm this affects the Linux kernel and multiple distributions and mentio...

CVE-2023-2166

CVE-2023-2166 pertains to a NULL pointer dereference in the Linux kernel CAN protocol (net/can/af_can.c). The issue is that ml_priv may not be initialized in the receive path for CAN frames, enabling a local attacker to crash the system or potentially cause a denial of service via a malformed or ...

CVE-2023-5178

CVE-2023-5178 is a use-after-free vulnerability in the NVMe over Fabrics over TCP subsystem of the Linux kernel, specifically nvmet_tcp_free_crypto in drivers/nvme/target/tcp.c. The logical bug can lead to use-after-free and double-free conditions, with potential remote code execution or local pr...

CVE-2017-7308

CVE-2017-7308 applies to the Linux kernel AF_PACKET packet_set_ring implementation. The issue arises from insufficient validation of certain block-size data in net/packet/af_packet.c, enabling a local user with CAP_NET_RAW to trigger a denial of service (integer signedness error and out-of-bounds...

CVE-2022-47929

CVE-2022-47929 is a Linux kernel vulnerability: a NULL pointer dereference in the traffic control subsystem (affecting qdisc_graft in net/sched/sch_api.c) that allows an unprivileged user to trigger a denial of service (system crash) via crafted tc qdisc/class configurations. Exploitation is loca...

CVE-2023-4389

CVE-2023-4389 concerns a flaw in btrfs_get_root_ref (fs/btrfs/disk-io.c) of the Linux kernel where the reference count is decremented twice. The connected Astra Linux security bulletin confirms the issue affects the Linux kernel used in that distro (linux-5.10) and describes a local-privilege sce...

CVE-2026-43503

The CVE-2026-43503 entry concerns Linux kernel net/skbuff handling: when frags are moved by frag-transfer helpers (notably __pskb_copy_fclone() and skb_shift()), the SKBFL_SHARED_FRAG flag was not propagated to the destination skb, causing destination pages to remain shared while skb_has_shared_f...

CVE-2019-19046

CVE-2019-19046 is a memory-leak in Linux kernel drivers/char/ipmi/ipmi_msghandler.c (__ipmi_bmc_register) up to kernel 5.3.11. An ida_simple_get() failure can cause memory consumption leading to DoS; exploitation details are described in the CVE entry, including note that third parties dispute th...

CVE-2020-27786

CVE-2020-27786 affects the Linux kernel MIDI subsystem (rawmidi) with a use-after-free in the MIDI ioctl handling path. A local attacker with access to issue ioctl commands to MIDI devices could trigger memory corruption, potentially enabling privilege escalation. Public documentation in connecte...

CVE-2023-52450

CVE-2023-52450 : In the Linux kernel, a NULL pointer dereference vulnerability exists in perf/x86/intel/uncore when discovering UPI topology. The fix changes topology discovery to obtain the logical socket id rather than the physical id, preventing an out-of-bounds access in upi_fill_topology() v...

CVE-2021-43389

CVE-2021-43389 affects the Linux kernel (pre-5.14.15) with an array-index-out-of-bounds flaw in the ISDN CAPI detach_capi_ctr function (kcapi.c). Multiple sources describe this as a local privilege‑escalation/DoS risk, where a privileged attacker could cause memory corruption, DoS, or potentially...

CVE-2022-0516

CVE-2022-0516 affects the KVM for s390 in the Linux kernel, specifically the arch/s390/kvm/kvm-s390.c function kvm_s390_guest_sida_op. The vulnerability allows a local user with normal privileges to obtain unauthorized memory write access due to an insufficient check in the KVM s390x release_agen...

CVE-2024-26588

CVE-2024-26588 – LoongArch: BPF: Prevent out-of-bounds memory access . Linux kernel BPF JIT compilation on LoongArch can fault while loading large BPF programs (e.g., 2039 insns) due to an out-of-bounds access during build_body/bpf_int_jit_compile sequence, triggering an unhandled page fault. The...

CVE-2018-5803

CVE-2018-5803 affects the Linux kernel SCTP chunk handling: a length check flaw in _sctp_make_chunk() (net/sctp/sm_make_chunk.c) can trigger a kernel crash/DoS. Affected kernel versions include 4.15.8, 4.14.25, 4.9.87, 4.4.121, 4.1.51, and 3.2.102. Public advisories (Debian, CentOS/Red Hat, Ubunt...

CVE-2021-3444

CVE-2021-3444 affects the Linux kernel’s eBPF verifier, where mod32 destination register truncation can be mishandled when the source is known to be zero. This enables a local attacker loading BPF programs to read kernel memory (information disclosure) and potentially perform out-of-bounds writes...

CVE-2023-38409

CVE-2023-38409 affects the Linux kernel fbcon subsystem (drivers/video/fbdev/core/fbcon.c). The issue arises in set_con2fb_map: an assignment is performed only for the first virtual console, which can desynchronize fbcon_registered_fb and fbcon_display when fbcon_mode_deleted is invoked, leaving ...

CVE-2021-4203

CVE-2021-4203 is a Linux kernel use-after-free read flaw in sock_getsockopt() triggered by a race between SO_PEERCRED/SO_PEERGROUPS and listen()/connect(). An authenticated local attacker could crash the system or leak kernel information. The connected IBM advisories document affected products (I...

CVE-2003-0001

The CVE-2003-0001 issue, known as Etherleak, is an information-disclosure vulnerability caused by NIC/device drivers not padding Ethernet frames with null bytes, allowing an adjacent attacker to glimpse memory content from previously transmitted packets. Connected documents show this vulnerabilit...

CVE-2026-53359

CVE-2026-53359 is a KVM/x86 shadow MMU use-after-free caused by a role mismatch when reusing shadow pages during a nested walk. The flaw arises when a PDE is modified and a 4KB leaf SPTE is installed on the new path, but the parent 2MB page’s direct flag and the shadow page’s role may not align, ...

CVE-2015-1328

CVE-2015-1328 affects the Linux kernel overlayfs by failing to properly check permissions for file creation in the upperdir when overlayfs is allowed in an arbitrary mount namespace. This enables local users to escalate to root on systems with overlayfs and user namespaces enabled, notably Ubuntu...

CVE-2022-41218

CVE-2022-41218 is a Linux kernel use-after-free in the DVB core (drivers/media/dvb-core/dmxdev.c) caused by refcount races, affecting dvb_demux_open and dvb_dmxdev_release. The issue is local, with potential denial of service or privilege escalation as implied by downstream advisories. Public rec...

CVE-2019-3882

CVE-2019-3882 affects the Linux kernel vfio interface: a local user owning a vfio device could abuse DMA mappings to memory and exhaust system memory, enabling a denial of service. Publicly available connected documents confirm the vulnerability and its DoS impact; Debian and other advisories inc...

CVE-2020-36766

The CVE-2020-36766 issue affects the Linux kernel prior to 5.8.6. In drivers/media/cec/core/cec-api.c, memory leakage of one kernel byte to unprivileged users occurs due to directly assigning log_addrs with a hole in the struct. The vulnerability is local (requires local access) and has a low ove...

CVE-2017-6074

CVE-2017-6074 affects the Linux kernel up to 4.9.11, where dccp_rcv_state_process in net/dccp/input.c mishandles DCCP_PKT_REQUEST data in LISTEN state. This can allow a local user to gain root privileges or trigger a denial of service (double free) via an application using IPV6_RECVPKTINFO setsoc...