CVE-2020-1749

CVE-2020-1749 describes a flaw in the Linux kernel’s IPsec networking implementation (notably VXLAN and GENEVE tunnels over IPv6). When an encrypted tunnel is established between two hosts, tunneled data may be misrouted over the encrypted link, causing data to be sent unencrypted and potentially...

CVE-2021-3489

CVE-2021-3489 concerns the Linux kernel eBPF RINGBUF: the bpf_ringbuf_reserve() function could allocate a size larger than the ringbuf, enabling out-of-bounds writes and potential arbitrary code execution. The issue was fixed by commit 4b81ccebaeee ("bpf, ringbuf: Deny reserve of buffers larger t...

CVE-2020-12464

CVE-2020-12464 is a Linux kernel use-after-free in the USB core path. The vulnerability stems from usb_sg_cancel in drivers/usb/core/message.c where a transfer can occur without a proper reference, enabling a local attacker to potentially crash or execute code. Connected documents confirm this is...

CVE-2022-40133

CVE-2022-40133 : A use-after-free in the Linux kernel vmwgfx driver (function vmw_execbuf_tie_context in drivers/gpu/vmxgfx/vmxgfx_execbuf.c) can be triggered by local unprivileged/user-space activity via the render node (/dev/dri/renderD128). Exploitation may allow a local attacker to gain eleva...

CVE-2019-15090

CVE-2019-15090 affects the Linux kernel driver component drivers/scsi/qedi/qedi_dbg.c, with an out-of-bounds read in the qedi_dbg_* family of functions for versions before 5.1.12. The issue can enable a local attacker to read memory due to improper bounds handling, as described in the CVE entry. ...

CVE-2022-38457

CVE-2022-38457 affects the vmwgfx driver (Linux kernel) in the function vmw_cmd_res_check within drivers/gpu/vmxgfx/vmxgfx_execbuf.c, exposed via /dev/dri/renderD128. The issue is a use-after-free, leading to local privilege escalation and DoS. Connected advisories ( MiracleLinux AXSA) reference ...

CVE-2019-16234

CVE-2019-16234 concerns the Linux kernel, where in 5.2.14 the PCIe wireless driver (iwlwifi/pcie/trans.c) does not check the result of alloc_workqueue, enabling a NULL pointer dereference. In public advisories, this CVE is tied to Unity Linux 20, which lists the kernel 5.2.14 issue as affecting i...

CVE-2023-52448

CVE-2023-52448 affects the Linux kernel gfs2 subsystem. Syzkaller reported a NULL pointer dereference in gfs2_rgrp_dump when rgd->rd_rgl is accessed, potentially after rgd->rd_gl creation fails in read_rindex_entry(). The fix adds a NULL pointer check in gfs2_rgrp_dump() to prevent derefere...

CVE-2019-19062

CVE-2019-19062 describes a memory leak in the crypto_report() function (crypto/crypto_user_base.c) of Linux kernels up to 5.3.11, which can cause denial of service via memory exhaustion when crypto_report_alg() failures occur. The connected documents confirm the vulnerability and its impact but d...

CVE-2019-19332

CVE-2019-19332 affects the Linux kernel KVM implementation (x86) with an out-of-bounds memory write in handling the KVM_GET_EMULATED_CPUID ioctl, enabling a local user with access to /dev/kvm to crash the system (DoS). Affected range is kernels 3.13–5.4. Root cause described as a missing/bounds-c...

CVE-2021-3573

CVE-2021-3573 is a local-use-after-free vulnerability in the Linux kernel Bluetooth HCI subsystem (function hci_sock_bound_ioctl) where a race between ioct HCIUNBLOCKADDR and hci_unregister_dev() and calls such as hci_sock_blacklist_add()/del(), hci_get_conn_info(), and hci_get_auth_info() can le...

CVE-2022-3903

CVE-2022-3903 describes an incorrect read request flaw in the Linux kernel’s Infrared Transceiver USB driver. When a user attaches a malicious USB device, a local user can cause resource starvation, leading to denial of service or potentially a system crash. Connected advisories (Unity Linux UTSA...

CVE-2023-2008

The CVE-2023-2008 flaw is in the Linux kernel udmabuf device driver, within its fault handler. It stems from insufficient validation of user-supplied data, allowing a memory access past the end of an array. This can enable local privilege escalation and execution of arbitrary code in the kernel c...

CVE-2019-15217

The CVE-2019-15217 entry concerns a NULL pointer dereference in the Linux kernel before 5.2.3, triggered by a malicious USB device via the zr364xx USB driver (drivers/media/usb/zr364xx/zr364xx.c). The issue can lead to a denial of service on a physical USB attack vector. Public references indicat...

CVE-2021-43976

CVE-2021-43976 affects the Linux kernel, specifically the Marvell mwifiex_usb_recv() function in drivers/net/wireless/marvell/mwifiex/usb.c. A local attacker with access to a crafted USB device can trigger a denial of service (skb_over_panic). The advisory notes the vulnerability exists in kernel...

CVE-2021-46951

CVE-2021-46951 (Linux kernel) concerns a local vulnerability in TPM support where tpm_read_log_efi could trigger integer underflow of efi_tpm_final_log_size when a TPM2 driver is loaded/unloaded repeatedly. The issue arises from subtracting final_events_preboot_size from a global final log size, ...

CVE-2026-46300

The CVE-2026-46300 issue affects the Linux kernel's net: skbuff code: skb_try_coalesce() can transfer paged frags from one skb to another while losing the SKBFL_SHARED_FRAG marker, breaking the invariant relied on by ESP decryption logic. This can allow an in-place decrypt path to operate on page...

CVE-2020-25212

CVE-2020-25212 affects the NFSv4 client in the Linux kernel and is caused by a TOCTOU mismatch where a size check is performed in fs/nfs/nfs4proc.c instead of fs/nfs/nfs4xdr.c. This can allow a local attacker to corrupt memory or cause unspecified impacts. The issue is addressed in the upstream k...

CVE-2020-25643

CVE-2020-25643 affects the Linux kernel HDLC_PPP module via improper input validation in ppp_cp_parse_cr, causing memory corruption and a read overflow that can lead to system crash or DoS. Public advisories confirm this vulnerability and reference the same root cause, with mitigations proposed a...

CVE-2020-26541

CVE-2020-26541 : Local attacker can bypass the Secure Boot Forbidden Signature Database (dbx) protection in Linux kernels up to 5.8.13, affecting certs/blacklist.c and certs/system_keyring.c. Impact involves potential system integrity/confidentiality compromise. Connected sources confirm the issu...

CVE-2021-28660

CVE-2021-28660 affects the Realtek RTL8188EU WiFi driver (drivers/staging/rtl8188eu/os_dep/ioctl_linux.c) in the Linux kernel and is caused by writing beyond the end of the ssid[] array in rtw_wx_set_scan. The Connected documents confirm this exact issue across multiple advisories (e.g., Debian L...

CVE-2023-5178

CVE-2023-5178 is a use-after-free vulnerability in the NVMe over Fabrics over TCP subsystem of the Linux kernel, specifically nvmet_tcp_free_crypto in drivers/nvme/target/tcp.c. The logical bug can lead to use-after-free and double-free conditions, with potential remote code execution or local pr...

CVE-2020-8834

Affected software: Linux kernel KVM for PowerPC (KVM with Book3S HV on Power8). Vulnerability arises from conflicting use of HSTATE_HOST_R1 to store r1 state in kvmppc_hv_entry and in kvmppc_save_tm()/kvmppc_restore_tm, leading to stack corruption. Consequence: a guest VM kernel-space code execut...

CVE-2022-0516

CVE-2022-0516 affects the KVM for s390 in the Linux kernel, specifically the arch/s390/kvm/kvm-s390.c function kvm_s390_guest_sida_op. The vulnerability allows a local user with normal privileges to obtain unauthorized memory write access due to an insufficient check in the KVM s390x release_agen...

CVE-2019-15030

CVE-2019-15030 affects the Linux kernel on powerpc up to 5.2.14. A local user can read another local process’s vector registers by exploiting a Facility Unavailable exception when starting a transaction (tbegin) and then accessing vector registers; at some point, vector registers may be corrupted...

CVE-2019-9213

CVE-2019-9213 : Linux kernel mmap minimum address check in mm/mmap.c is insufficient, enabling a NULL pointer dereference exploit on platforms without SMAP/PAN. Affected: kernels before 4.20.14. Mitigation: upgrade to 4.20.14 or later (see ChangeLog-4.20.14; USN-3931-2).

CVE-2024-26588

CVE-2024-26588 – LoongArch: BPF: Prevent out-of-bounds memory access . Linux kernel BPF JIT compilation on LoongArch can fault while loading large BPF programs (e.g., 2039 insns) due to an out-of-bounds access during build_body/bpf_int_jit_compile sequence, triggering an unhandled page fault. The...

CVE-2018-21008

CVE-2018-21008 affects the Linux kernel up to version 4.16.6, with a use-after-free in rsi_mac80211_detach (drivers/net/wireless/rsi/rsi_91x_mac80211.c). Nessus/nvd-derived docs consistently reference this flaw across Unity Linux advisories and related feeds, confirming the vulnerable component a...

CVE-2021-3656

CVE-2021-3656 describes a flaw in the KVM hypervisor for AMD processors where the L1 guest can provide a VMCB with an improperly validated virt_ext field, allowing the L1 to disable VMLOAD/VMSAVE intercepts and VLS for the L2 guest. This enables the L2 guest to read/write portions of the host’s p...

CVE-2022-28388

CVE-2022-28388 affects the Linux kernel driver usb_8dev_start_xmit (drivers/net/can/usb/usb_8dev.c). The vulnerability is a double free in the function usb_8dev_start_xmit, present up to kernel versions including 5.17.1. Documents reference a commit addressing the issue and mention downstream adv...

CVE-2022-3028

CVE-2022-3028 describes a race condition in the Linux kernel’s IP framework (XFRM) where concurrent calls to xfrm_probe_algs can cause an out-of-bounds read that may be copied into a socket, or an out-of-bounds write, enabling a local attacker to leak kernel memory or crash the kernel. Connected ...

CVE-2020-14381

CVE-2020-14381 is a vulnerability in the Linux kernel futex implementation. A local attacker can corrupt memory or escalate privileges when creating a futex on a filesystem that is about to be unmounted. The issue is local, with attack vector and conditions described as exploitation requiring loc...

CVE-2021-43389

CVE-2021-43389 affects the Linux kernel (pre-5.14.15) with an array-index-out-of-bounds flaw in the ISDN CAPI detach_capi_ctr function (kcapi.c). Multiple sources describe this as a local privilege‑escalation/DoS risk, where a privileged attacker could cause memory corruption, DoS, or potentially...

CVE-2023-52450

CVE-2023-52450 : In the Linux kernel, a NULL pointer dereference vulnerability exists in perf/x86/intel/uncore when discovering UPI topology. The fix changes topology discovery to obtain the logical socket id rather than the physical id, preventing an out-of-bounds access in upi_fill_topology() v...

CVE-2019-19462

CVE-2019-19462 affects Linux kernel: relay_open in kernel/relay.c, vulnerable through kernel version 5.4.1, allows local attackers to cause a denial of service (e.g., relay blockage) by triggering a NULL alloc_percpu result. The connected UNITY_LINUX advisories reproduce this description and refe...

CVE-2020-8428

CVE-2020-8428 refers to a use-after-free in the Linux kernel’s VFS layer (fs/namei.c/vfs core) that can be exploited by a local attacker to cause a denial of service or potentially read kernel memory. Public advisories (Debian DSA-4667/DSA-4667-1) attribute the issue to a may_create_in_sticky use...

CVE-2023-31436

Summary: CVE-2023-31436 affects the Linux kernel net/sched/qfq subsystem (qfq_change_class in net/sched/sch_qfq.c). The flaw allows a heap/out-of-bounds write because lmax can exceed QFQ_MIN_LMAX, leading to information disclosure, privilege escalation, or denial of service as described in public...

CVE-2020-27820

CVE-2020-27820: Linux kernel use-after-free in nouveau's postclose() during device removal (or unbind). Exploitation local; affects nouveau driver paths; impact: high availability risk, no confidentiality/integrity impact per CVSS. Documents indicate a fix exists in kernel patches (e.g., advisori...

CVE-2023-4389

CVE-2023-4389 concerns a flaw in btrfs_get_root_ref (fs/btrfs/disk-io.c) of the Linux kernel where the reference count is decremented twice. The connected Astra Linux security bulletin confirms the issue affects the Linux kernel used in that distro (linux-5.10) and describes a local-privilege sce...

CVE-2019-12382

CVE-2019-12382 affects Linux kernels up to 5.1.5 in drm_load_edid_firmware (drm_edid_load.c). There is an unchecked kstrdup of fwstr, which could lead to a denial of service via a NULL pointer dereference and system crash. The description notes the vendor disputes this as a vulnerability because ...

CVE-2019-19046

CVE-2019-19046 is a memory-leak in Linux kernel drivers/char/ipmi/ipmi_msghandler.c (__ipmi_bmc_register) up to kernel 5.3.11. An ida_simple_get() failure can cause memory consumption leading to DoS; exploitation details are described in the CVE entry, including note that third parties dispute th...

CVE-2020-25284

The CVE-2020-25284 issue concerns the Rados Block Device (rbd) driver in the Linux kernel. Affected code path is in the rbd subsystem (drivers/block/rbd.c) where permission checks to access rbd devices were incomplete, enabling a local attacker to map or unmap rbd block devices. Multiple connecte...

CVE-2020-27786

CVE-2020-27786 affects the Linux kernel MIDI subsystem (rawmidi) with a use-after-free in the MIDI ioctl handling path. A local attacker with access to issue ioctl commands to MIDI devices could trigger memory corruption, potentially enabling privilege escalation. Public documentation in connecte...

CVE-2022-47929

CVE-2022-47929 is a Linux kernel vulnerability: a NULL pointer dereference in the traffic control subsystem (affecting qdisc_graft in net/sched/sch_api.c) that allows an unprivileged user to trigger a denial of service (system crash) via crafted tc qdisc/class configurations. Exploitation is loca...

CVE-2003-0001

The CVE-2003-0001 issue, known as Etherleak, is an information-disclosure vulnerability caused by NIC/device drivers not padding Ethernet frames with null bytes, allowing an adjacent attacker to glimpse memory content from previously transmitted packets. Connected documents show this vulnerabilit...

CVE-2017-7308

CVE-2017-7308 applies to the Linux kernel AF_PACKET packet_set_ring implementation. The issue arises from insufficient validation of certain block-size data in net/packet/af_packet.c, enabling a local user with CAP_NET_RAW to trigger a denial of service (integer signedness error and out-of-bounds...

CVE-2023-2166

CVE-2023-2166 pertains to a NULL pointer dereference in the Linux kernel CAN protocol (net/can/af_can.c). The issue is that ml_priv may not be initialized in the receive path for CAN frames, enabling a local attacker to crash the system or potentially cause a denial of service via a malformed or ...

CVE-2023-38409

CVE-2023-38409 affects the Linux kernel fbcon subsystem (drivers/video/fbdev/core/fbcon.c). The issue arises in set_con2fb_map: an assignment is performed only for the first virtual console, which can desynchronize fbcon_registered_fb and fbcon_display when fbcon_mode_deleted is invoked, leaving ...

CVE-2021-33655

CVE-2021-33655 is confirmed in the provided documents as an out-of-bounds memory write triggered by malicious data sent via the framebuffer ioctl FBIOPUT_VSCREENINFO in the Linux kernel framebuffer/console path. The issue allows a local user to crash the system and potentially escalate privileges...

CVE-2021-3444

CVE-2021-3444 affects the Linux kernel’s eBPF verifier, where mod32 destination register truncation can be mishandled when the source is known to be zero. This enables a local attacker loading BPF programs to read kernel memory (information disclosure) and potentially perform out-of-bounds writes...