CVE-2022-28388

CVE-2022-28388 affects the Linux kernel driver usb_8dev_start_xmit (drivers/net/can/usb/usb_8dev.c). The vulnerability is a double free in the function usb_8dev_start_xmit, present up to kernel versions including 5.17.1. Documents reference a commit addressing the issue and mention downstream adv...

CVE-2022-40133

CVE-2022-40133 : A use-after-free in the Linux kernel vmwgfx driver (function vmw_execbuf_tie_context in drivers/gpu/vmxgfx/vmxgfx_execbuf.c) can be triggered by local unprivileged/user-space activity via the render node (/dev/dri/renderD128). Exploitation may allow a local attacker to gain eleva...

CVE-2019-16234

CVE-2019-16234 concerns the Linux kernel, where in 5.2.14 the PCIe wireless driver (iwlwifi/pcie/trans.c) does not check the result of alloc_workqueue, enabling a NULL pointer dereference. In public advisories, this CVE is tied to Unity Linux 20, which lists the kernel 5.2.14 issue as affecting i...

CVE-2021-43389

CVE-2021-43389 affects the Linux kernel (pre-5.14.15) with an array-index-out-of-bounds flaw in the ISDN CAPI detach_capi_ctr function (kcapi.c). Multiple sources describe this as a local privilege‑escalation/DoS risk, where a privileged attacker could cause memory corruption, DoS, or potentially...

CVE-2023-5178

CVE-2023-5178 is a use-after-free vulnerability in the NVMe over Fabrics over TCP subsystem of the Linux kernel, specifically nvmet_tcp_free_crypto in drivers/nvme/target/tcp.c. The logical bug can lead to use-after-free and double-free conditions, with potential remote code execution or local pr...

CVE-2019-5489

CVE-2019-5489 affects the Linux kernel mincore() implementation (mm/mincore.c) up to version 4.19.13. It enables a local attacker to observe page cache access patterns of other processes sharing memory, leading to potential information disclosure; the impact is described as partial confidentialit...

CVE-2020-11494

The CVE-2020-11494 issue affects the Linux kernel slcan (serial line CAN) driver: in slcan.c, CAN headers for received packets may not be fully initialised when receiving data, enabling local attackers to read uninitialised can_frame data from kernel memory (information leak). Root cause is incom...

CVE-2021-3489

CVE-2021-3489 concerns the Linux kernel eBPF RINGBUF: the bpf_ringbuf_reserve() function could allocate a size larger than the ringbuf, enabling out-of-bounds writes and potential arbitrary code execution. The issue was fixed by commit 4b81ccebaeee ("bpf, ringbuf: Deny reserve of buffers larger t...

CVE-2021-3609

CVE-2021-3609 is a local privilege-escalation flaw in the Linux kernel CAN BCM subsystem. A race in net/can/bcm.c between bcm_rx_handler() and bcm_release() can free bcm_op/bcm_sock structures while the handler runs, enabling use-after-free and root access. Public advisories consistently describe...

CVE-2018-16884

The CVE-2018-16884 issue affects the Linux kernel NFS4.1+ client: mounting NFS shares across different network namespaces can cause a use-after-free in bc_svc_process() leading to memory corruption and potential host panic. Exploitation details in the provided sources are host/container local, wi...

CVE-2023-31083

CVE-2023-31083 affects the Linux kernel (drivers/bluetooth/hci_ldisc.c). In hci_uart_tty_ioctl, there is a race between HCIUARTSETPROTO and HCIUARTGETPROTO where HCI_UART_PROTO_SET is written before hu->proto is set, which may cause a NULL pointer dereference. The connected advisories confirm ...

CVE-2018-1000204

CVE-2018-1000204 affects Linux kernel versions 3.18–4.16 where an SG_IO ioctl on /dev/sg0 with dxfer_direction=SG_DXFER_FROM_DEV and an empty 6-byte cmdp can cause the kernel to copy up to 1000 heap pages to userspace. The root cause is improper handling of SG_IO data flow leading to information ...

CVE-2020-27170

The CVE-2020-27170 flaw affects the Linux kernel prior to 5.11.8, where in kernel/bpf/verifier.c there is undesirable out-of-bounds speculation on pointer arithmetic. This can enable a side-channel attack that defeats Spectre mitigations and may allow an attacker to obtain sensitive information f...

CVE-2023-52448

CVE-2023-52448 affects the Linux kernel gfs2 subsystem. Syzkaller reported a NULL pointer dereference in gfs2_rgrp_dump when rgd->rd_rgl is accessed, potentially after rgd->rd_gl creation fails in read_rindex_entry(). The fix adds a NULL pointer check in gfs2_rgrp_dump() to prevent derefere...

CVE-2022-1055

CVE-2022-1055 affects the Linux kernel: a use-after-free in tc_new_tfilter within net/sched/cls_api.c can enable privilege escalation when unprivileged user namespaces are in use. The issue allows a local attacker to escalate privileges; exploitation relies on specific local conditions. A fix is ...

CVE-2022-1184

CVE-2022-1184 affects the Linux kernel ext4 file-system code (fs/ext4/namei.c:dx_insert_block). The flaw is a use-after-free that can be triggered by a local user to cause a denial of service. Astra Linux bulletin also documents this exact issue. The connected documents do not specify a fixed ver...

CVE-2023-31436

Summary: CVE-2023-31436 affects the Linux kernel net/sched/qfq subsystem (qfq_change_class in net/sched/sch_qfq.c). The flaw allows a heap/out-of-bounds write because lmax can exceed QFQ_MIN_LMAX, leading to information disclosure, privilege escalation, or denial of service as described in public...

CVE-2015-1421

CVE-2015-1421 is a use-after-free in the Linux kernel SCTP path (sctp_assoc_update in net/sctp/associola.c) that allows a remote attacker to trigger an INIT collision, leading to slab corruption and a kernel panic (DoS) with potentially other impact. Affected condition: kernel versions prior to 3...

CVE-2023-38409

CVE-2023-38409 affects the Linux kernel fbcon subsystem (drivers/video/fbdev/core/fbcon.c). The issue arises in set_con2fb_map: an assignment is performed only for the first virtual console, which can desynchronize fbcon_registered_fb and fbcon_display when fbcon_mode_deleted is invoked, leaving ...

CVE-2019-11815

The CVE-2019-11815 issue affects Linux kernels with net/rds/tcp.c: rds_tcp_kill_sock contains a race that can cause a use-after-free during net namespace cleanup (pre-5.0.8). A fix was committed and released in 5.0.8; upgrading to 5.0.8+ (or applying the patch) is the advised remediation. The Uni...

CVE-2020-10767

CVE-2020-10767 affects the Linux kernel before 5.8-rc1, where Enhanced IBPB mitigation is disabled when STIBP is unavailable or when IBRS is available, enabling a Spectre V2–style attack on local confidentiality. Connected advisories confirm Linux kernel mitigations (IBPB/SSBD) and note a patched...

CVE-2021-23133

CVE-2021-23133 is a race condition in the Linux kernel SCTP sockets (net/sctp/socket.c) prior to 5.12-rc8. If sctp_destroy_sock executes without sock_net(sk)->sctp.addr_wq_lock, an element is removed from the auto_asconf_splist list without proper locking, enabling a local attacker with networ...

CVE-2021-38160

CVE-2021-38160 affects the Linux kernel “virtio_console” driver. In drivers/char/virtio_console.c, if an untrusted device supplies a buf->len value larger than the destination buffer, data corruption or loss can occur. The issue is fixed in Linux kernel 5.13.4 (ChangeLog-5.13.4). The vendor no...

CVE-2019-19045

CVE-2019-19045 affects the Linux kernel prior to 5.3.11 due to a memory leak in mlx5_fpga_conn_create_cq() (drivers/net/ethernet/mellanox/mlx5/core/fpga/conn.c). The issue allows local attackers to cause memory DoS by triggering mlx5_vector2eqn() failures. Ubuntu/Unity/SUSE advisories cite the sa...

CVE-2019-19060

CVE-2019-19060 is a memory-leak vulnerability in the Linux kernel (discovered in adis_buffer.c: adis_update_scan_mode()) that can lead to memory exhaustion and DoS. Affected: Linux kernel versions before 5.3.9 (drivers/iio/imu/adis_buffer.c). Exploitation details are not provided in the documents...

CVE-2020-25284

The CVE-2020-25284 issue concerns the Rados Block Device (rbd) driver in the Linux kernel. Affected code path is in the rbd subsystem (drivers/block/rbd.c) where permission checks to access rbd devices were incomplete, enabling a local attacker to map or unmap rbd block devices. Multiple connecte...

CVE-2019-11190

CVE-2019-11190 affects the Linux kernel prior to 4.8. Local users could bypass ASLR on setuid programs (e.g., /bin/su) due to install_exec_creds() being invoked late in load_elf_binary() in fs/binfmt_elf.c, creating a race in ptrace_may_access() when reading /proc/pid/stat. Connected advisories (...

CVE-2021-3656

CVE-2021-3656 describes a flaw in the KVM hypervisor for AMD processors where the L1 guest can provide a VMCB with an improperly validated virt_ext field, allowing the L1 to disable VMLOAD/VMSAVE intercepts and VLS for the L2 guest. This enables the L2 guest to read/write portions of the host’s p...

CVE-2022-38457

CVE-2022-38457 affects the vmwgfx driver (Linux kernel) in the function vmw_cmd_res_check within drivers/gpu/vmxgfx/vmxgfx_execbuf.c, exposed via /dev/dri/renderD128. The issue is a use-after-free, leading to local privilege escalation and DoS. Connected advisories ( MiracleLinux AXSA) reference ...

CVE-2023-2008

The CVE-2023-2008 flaw is in the Linux kernel udmabuf device driver, within its fault handler. It stems from insufficient validation of user-supplied data, allowing a memory access past the end of an array. This can enable local privilege escalation and execution of arbitrary code in the kernel c...

CVE-2020-25212

CVE-2020-25212 affects the NFSv4 client in the Linux kernel and is caused by a TOCTOU mismatch where a size check is performed in fs/nfs/nfs4proc.c instead of fs/nfs/nfs4xdr.c. This can allow a local attacker to corrupt memory or cause unspecified impacts. The issue is addressed in the upstream k...

CVE-2019-19332

CVE-2019-19332 affects the Linux kernel KVM implementation (x86) with an out-of-bounds memory write in handling the KVM_GET_EMULATED_CPUID ioctl, enabling a local user with access to /dev/kvm to crash the system (DoS). Affected range is kernels 3.13–5.4. Root cause described as a missing/bounds-c...

CVE-2020-12769

CVE-2020-12769 affects the Linux kernel prior to 5.4.17. The issue is in drivers/spi/spi-dw.c, where concurrent calls to dw_spi_irq and dw_spi_transfer_one can trigger a kernel panic (local exploit). The vulnerability is fixed in Linux kernel 5.4.17 (see ChangeLog-5.4.17). No exploit details are ...

CVE-2020-14381

CVE-2020-14381 is a vulnerability in the Linux kernel futex implementation. A local attacker can corrupt memory or escalate privileges when creating a futex on a filesystem that is about to be unmounted. The issue is local, with attack vector and conditions described as exploitation requiring loc...

CVE-2021-3491

CVE-2021-3491 concerns the Linux kernel io_uring PROVIDE_BUFFERS path, where the MAX_RW_COUNT limit could be bypassed, causing negative values to be used in mem_rw during /proc//mem reads. This could enable a heap overflow and potential arbitrary code execution in the kernel. The issue was addres...

CVE-2023-31248

The Linux kernel contains a use-after-free vulnerability in the Netfilter nf_tables implementation. The flaw exists because the nft_chain_lookup_byid() function fails to verify whether a chain is active, particularly during concurrent access to resources. This vulnerability allows a local attacke...

CVE-2024-26588

CVE-2024-26588 – LoongArch: BPF: Prevent out-of-bounds memory access . Linux kernel BPF JIT compilation on LoongArch can fault while loading large BPF programs (e.g., 2039 insns) due to an out-of-bounds access during build_body/bpf_int_jit_compile sequence, triggering an unhandled page fault. The...

CVE-2019-15090

CVE-2019-15090 affects the Linux kernel driver component drivers/scsi/qedi/qedi_dbg.c, with an out-of-bounds read in the qedi_dbg_* family of functions for versions before 5.1.12. The issue can enable a local attacker to read memory due to improper bounds handling, as described in the CVE entry. ...

CVE-2020-12464

CVE-2020-12464 is a Linux kernel use-after-free in the USB core path. The vulnerability stems from usb_sg_cancel in drivers/usb/core/message.c where a transfer can occur without a proper reference, enabling a local attacker to potentially crash or execute code. Connected documents confirm this is...

CVE-2020-8834

Affected software: Linux kernel KVM for PowerPC (KVM with Book3S HV on Power8). Vulnerability arises from conflicting use of HSTATE_HOST_R1 to store r1 state in kvmppc_hv_entry and in kvmppc_save_tm()/kvmppc_restore_tm, leading to stack corruption. Consequence: a guest VM kernel-space code execut...

CVE-2021-46951

CVE-2021-46951 (Linux kernel) concerns a local vulnerability in TPM support where tpm_read_log_efi could trigger integer underflow of efi_tpm_final_log_size when a TPM2 driver is loaded/unloaded repeatedly. The issue arises from subtracting final_events_preboot_size from a global final log size, ...

CVE-2022-3903

CVE-2022-3903 describes an incorrect read request flaw in the Linux kernel’s Infrared Transceiver USB driver. When a user attaches a malicious USB device, a local user can cause resource starvation, leading to denial of service or potentially a system crash. Connected advisories (Unity Linux UTSA...

CVE-2023-30456

CVE-2023-30456 affects Linux kernels with arch/x86/kvm/vmx/nested.c pre-6.2.8. The root cause is missing consistency checks for CR0 and CR4 in nVMX on x86_64, which can enable state inconsistency between VMX and guest. Public references indicate this has been addressed by 6.2.8 and via various AL...

CVE-2018-1000026

CVE-2018-1000026 affects the Linux kernel in the Broadcom NetXtreme II (bnx2x) driver. The issue is described as insufficient input validation in the bnx2x driver that can allow a remote attacker to trigger a denial of service by sending specially crafted, very large packets, potentially from an ...

CVE-2019-19062

CVE-2019-19062 describes a memory leak in the crypto_report() function (crypto/crypto_user_base.c) of Linux kernels up to 5.3.11, which can cause denial of service via memory exhaustion when crypto_report_alg() failures occur. The connected documents confirm the vulnerability and its impact but d...

CVE-2020-25211

CVE-2020-25211 describes a local vulnerability in the Linux kernel’s netfilter conntrack netlink path. A bounds check is missing in ctnetlink_parse_tuple_filter (net/netfilter/nf_conntrack_netlink.c), permitting a local attacker injecting conntrack netlink configuration to overflow a local buffer...

CVE-2022-0500

CVE-2022-0500 : A vulnerability in the Linux kernel’s BPF subsystem arises from unrestricted eBPF usage via BPF_BTF_LOAD, enabling a local user to trigger an out-of-bounds memory write when loading BTF data. Reported impact includes system crash and privilege escalation. The connected Astra Linux...

CVE-2023-52450

CVE-2023-52450 : In the Linux kernel, a NULL pointer dereference vulnerability exists in perf/x86/intel/uncore when discovering UPI topology. The fix changes topology discovery to obtain the logical socket id rather than the physical id, preventing an out-of-bounds access in upi_fill_topology() v...

CVE-2003-0001

The CVE-2003-0001 issue, known as Etherleak, is an information-disclosure vulnerability caused by NIC/device drivers not padding Ethernet frames with null bytes, allowing an adjacent attacker to glimpse memory content from previously transmitted packets. Connected documents show this vulnerabilit...

CVE-2017-11176

CVE-2017-11176 is a local vulnerability in the Linux kernel’s Netlink mq_notify path. The issue arises because mq_notify does not set the sock pointer to NULL when entering retry logic, enabling a use-after-free scenario during a user-space close of a Netlink socket. Public sources describe poten...