CVE-2025-38238

The CVE-2025-38238 issue affects the Linux kernel SCSI fnic driver, where a crash could occur when both FDMI RHBA and RPA requests time out and a frame is reused to send ABTS, leading to a double-free on completion. The fix allocates separate frames for RHBA and RPA and updates the ABTS handling ...

CVE-2025-38275

The CVE-2025-38275 entry concerns the Linux kernel, fixing a NULL vs IS_ERR() bug in the qcom-qmp-usb driver. The qmp_usb_iomap() helper previously returned devm_ioremap() results directly for non-exclusive mappings, which could be NULL. If callers only checked IS_ERR(), a NULL pointer could bypa...

CVE-2025-38287

Technical details about CVE-2025-38287 are not publicly provided in the supplied documents. Monitor official advisories for updates, affected products, and fixes.

CVE-2025-38323

Summary (CVE-2025-38323): In the Linux kernel, the ATM LECS code path (net/atm/lec.c) had a potential use-after-free due to a path that could leave a dangling pointer in dev_lec[] from lecd_attach(). The patch adds a mutex (lec_mutex) to protect dev_lecp[] uses from lecd_attach(), lec_vcc_attach(...

CVE-2025-38391

CVE-2025-38391 in the Linux kernel addresses a vulnerability in USB Type-C Alt Mode handling for DisplayPort. A misbehaving port partner could claim pin assignment capabilities beyond the valid range, causing an out-of-bounds access in pin_assignment_show. The fix adds a DP_PIN_ASSIGN_MAX constan...

CVE-2025-38417

The CVE-2025-38417 issue affects the Linux kernel ice/eswitch path where memory for VF port representors could be allocated during reset and not freed in legacy (non-switchdev) mode. The fix adds a mode check to allocate required port memory only in switchdev mode and prevents blindly allocating ...

CVE-2025-38418

CVE-2025-38418 affects the Linux kernel remoteproc subsystem. The root cause is a failure path in rproc_attach() where, if rproc_handle_resources() fails while the remote processor is in state RPROC_DETACHED, rproc->clean_table is not released, leading to a memory leak (observed in a kworker t...

CVE-2025-38462

CVE-2025-38462 affects the Linux kernel vsock subsystem. Root cause is a TOCTOU race in vsock_find_cid() and vsock_dev_do_ioctl() with module unload, where transport_g2h/h2g can become NULL after a NULL check, causing null-pointer derefs. The patch adds vsock_transport_local_cid() to guard agains...

CVE-2025-38502

Technical details beyond the initial description are not provided in the connected documents; no explicit product/version, impact specifics, or remediation are present here. Monitor for updates.

CVE-2025-38568

In the Linux kernel, net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing (CVE-2025-38568). The TCA_MQPRIO_TC_ENTRY_INDEX policy allowed up to TC_QOPT_MAX_QUEUE (16), causing a 4-byte out-of-bounds write in the fp[] stack array. The fix changes the policy to allow only up to TC_QO...

CVE-2026-23247

CVE-2026-23247 is a Linux kernel TCP/TCP options issue that reintroduces port inclusion in the TS offset to mitigate an off-path TCP source port leakage via a SYN-cookie side-channel. The vulnerability is resolved by reverting a previous downgrade of timestamp offsets and performing a single siph...

CVE-2026-43329

CVE-2026-43329 concerns the Linux kernel netfilter flowtable where the maximum number of hardware offload actions for IPv6 was exceeded (17 used vs 16 allowed). The fixes update flow_action_entry_next() to enforce the limit and raise the per-flow action cap from 16 to 24, enabling IPv6 setups to ...

CVE-1999-0183

CVE-1999-0183 affects Linux implementations of TFTP, described as allowing traversal to read files outside the restricted directory. The OpenVAS/Nessus entries confirm a directory-traversal vulnerability enabling arbitrary file reads via TFTP server responses (e.g., tftpd misconfiguration allows ...

CVE-2004-0178

The vulnerability lies in the Linux 2.4.x sb16 Sound Blaster driver (OSS) in 16-bit mode; under odd-sized samples it can crash local users. Affects Linux 2.4.x before 2.4.26. Remediation: upgrade to Linux 2.4.26 or newer.

CVE-2005-2456

CVE-2005-2456 refers to an array index overflow in the Linux kernel 2.6, in xfrm_user.c within xfrm_sk_policy_insert. A local user can trigger the overflow by supplying a p->dir value larger than XFRM_POLICY_OUT, causing writes beyond sock->sk_policy and resulting in a kernel crash (DoS) an...

CVE-2005-4605

CVE-2005-4605 concerns the Linux kernel procfs implementation. A signedness error in the proc_misc.c code (pre-2.6.15) allows a local attacker to read sensitive kernel memory by manipulating a signed value added to an unsigned value, disclosed via /proc interactions. Public reports document the a...

CVE-2006-2071

CVE-2006-2071 affects Linux kernels 2.4.x and 2.6.x up to 2.6.16. It arises from a flaw in the mprotect handling that allowed a local user to grant write permission to a read-only attachment of a shared memory segment, bypassing IPC permissions and enabling modification of the attachment. Reporte...

CVE-2006-6106

The CVE-2006-6106 entry describes several buffer overflows in the Bluetooth driver (net/bluetooth/cmtp/capi.c) of the Linux kernel, specifically in the cmtp_recv_interopmsg function. Affected products/versions include Linux kernel 2.4.22 up to 2.4.33.4 and 2.6.2 up to 2.6.18.5, with 2.6.19.x also...

CVE-2007-1497

CVE-2007-1497 affects the Linux kernel nf_conntrack netfilter code prior to 2.6.20.3. During IPv6 fragment reassembly, nfctinfo is not set, leaving the default IP_CT_ESTABLISHED and potentially allowing remote attackers to bypass certain netfilter rulesusing IPv6 fragments. The documented fix is ...

CVE-2007-6761

CVE-2007-6761 affects the Linux kernel up to version 2.6.23/24 era: the videobuf-vmalloc.c path (drivers/media/video) contains uninitialized videobuf_mapping data structures. This can allow a local attacker to trigger an incorrect memory-management state and a videobuf leak via unspecified vector...

CVE-2008-4618

The CVE-2008-4618 issue affects the Linux kernel SCTP implementation prior to 2.6.27, where a protocol violation with an invalid parameter length could trigger a panic and denial-of-service via SCTP processing paths (sctp_sf_violation_paramlen, sctp_sf_abort_violation, sctp_make_abort_violation; ...

CVE-2009-0747

The CVE-2009-0747 issue affects the Linux kernel’s ext4_isize helper in fs/ext4/ext4.h, exposing a denial-of-service risk when a local user mounts a crafted ext4 filesystem. The vulnerability arises from using the i_size_high structure member during operations on arbitrary file types, potentially...

CVE-2009-0748

CVE-2009-0748 affects the Linux kernel: ext4_fill_super in fs/ext4/super.c fails to validate the superblock configuration, enabling a local attacker to trigger a NULL pointer dereference/OOPS when mounting a crafted ext4 filesystem. Impact is local denial of service. Affected ranges: Linux kernel...

CVE-2009-3001

Technical details about CVE-2009-3001 are not provided in the connected documents; the initial description states a kernel infoleak via getsockname on AF_LLC, but no vendor/product/version specifics or fixes are included. Monitor for updates.

CVE-2011-0463

CVE-2011-0463 affects the OCFS2 code path in the Linux kernel. The issue is in the function ocfs2_prepare_page_for_write where holes crossing page boundaries are not handled correctly, enabling a local user to read potentially sensitive data from uninitialized disk locations. The description indi...

CVE-2011-0716

CVE-2011-0716 affects the Linux kernel older than 2.6.38. The vulnerability lies in the br_multicast_add_group function within net/bridge/br_multicast.c, triggered when a specific Ethernet bridge configuration is used. An attacker locally can cause memory corruption and a system crash by sending ...

CVE-2011-1021

The CVE-2011-1021 entry describes a local privilege escalation in the Linux kernel caused by the ACPI debugfs interface. Vulnerable component: drivers/acpi/debugfs.c. Affected software: Linux kernel versions before 3.0. Root-level access is required to write to /sys/kernel/debug/acpi/custom_metho...

CVE-2011-2700

CVE-2011-2700 affects the Linux kernel prior to 2.6.39.4 on the N900 platform, where multiple buffer overflows in si4713_write_econtrol_string (drivers/media/radio/si4713-i2c.c) can be triggered by a crafted s_ext_ctrls operation using V4L2_CID_RDS_TX_PS_NAME or V4L2_CID_RDS_TX_RADIO_TEXT. The is...

CVE-2011-2909

Summary (CVE-2011-2909): The Linux kernel (do_devinfo_ioctl in drivers/staging/comedi/comedi_fops.c) before 3.1 allows local users to leak sensitive kernel memory content through a copy of a short string. This is described as an information leak in the kernel staging area. Impact is local confide...

CVE-2012-5532

The CVE-2012-5532 issue exists in the Linux kernel hypervkvpd hv_kvp_daemon: the main function in tools/hv/hv_kvp_daemon.c allows a local user to trigger a denial of service (daemon exit) via a crafted Netlink message. It is noted as a consequence of an incorrect fix for CVE-2012-2669, and a patc...

CVE-2014-9895

Technical details for CVE-2014-9895 are not publicly available in the provided documents. The materials reference an information disclosure in media-device.c but do not specify affected versions, root cause, impact, or fixes within this corpus. Monitor for updates.

CVE-2016-2064

The CVE-2016-2064 entry concerns the MSM QDSP6 audio driver (Linux kernel 3.x) in sound/soc/msm/qdsp6v2/msm-audio-effects-q6-v2.c, used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices. The vulnerability arises from an ioctl handling flaw that allows a crafted applicatio...

CVE-2017-15128

The CVE-2017-15128 issue affects the Linux kernel’s hugetlb_mcopy_atomic_pte function (mm/hugetlb.c) prior to version 4.13.12, where a missing size check can lead to a denial of service (BUG). Public sources in connected advisories (e.g., EulerOS/Unity Linux Nessus plugins) corroborate that vulne...

CVE-2017-5546

CVE-2017-5546 affects Linux kernel 4.8.x and 4.9.x prior to 4.9.5. The freelist-randomization feature in mm/slab.c can be triggered by selecting a large random number, leading to duplicate freelist entries and a potential denial of service (system crash) or other impact in opportunistic circumsta...

CVE-2017-8069

CVE-2017-8069 affects the Linux kernel 4.9.x (prior to 4.9.11). The issue lies in drivers/net/usb/rtl8150.c interacting incorrectly with CONFIG_VMAP_STACK, which may allow a local user to trigger a denial of service (system crash or memory corruption) or other impact by abusing a DMA scatterlist ...

CVE-2021-47109

CVE-2021-47109 concerns the Linux kernel neighbour GC: on IPv6, NUD_NOARP entries can be GCed, potentially overflowing the neighbour table for valid connections. The description notes the issue is more prevalent after the patch with commit 58956317c8de (“neighbor: Improve garbage collection”), wh...

CVE-2021-47121

Rejected: CVE-2021-47121 entry withdrawn/not used; this CVE is not an active vulnerability entry.

CVE-2021-47190

Concrete details from the connected docs show CVE-2021-47190 affects the Linux kernel’s perf/bpf path. The issue is a memory leak in perf_env__insert_btf() when a duplicate BTF id is encountered; code was changed to have perf_env__insert_btf() return a success/error value and to free memory if in...

CVE-2021-47196

CVE-2021-47196 concerns a use-after-free in the Linux kernel mlx5_ib path during QP creation. The issue arises when RDMA/core code presets both receive and send completion queue pointers before forwarding to the driver, then overwrites ibqp properties and continues into the driver path. If mlx5_q...

CVE-2021-47243

The CVE-2021-47243 issue concerns the Linux kernel's cake_qdisc TCP option parser. Affected code paths cake_get_tcpopt and cake_tcph_may_drop could read one byte out of bounds when processing TCP options, particularly if the option length is 1, leading to a second read for opcodes not equal to TC...

CVE-2021-47290

CVE-2021-47290 affects the Linux kernel SCSI target path (XCOPY completion) where a NULL pointer dereference could occur due to an NULL se_tpg_wwn pointer in the extended copy workflow. The root cause is that LIO’s EXTENDED COPY worker dispatches reads/writes via a global xcopy_pt_tpg, which may ...

CVE-2021-47341

CVE-2021-47341 concerns the Linux kernel KVM mmio path, where a use-after-free flaw in kvm_vm_ioctl_unregister_coalesced_mmio could enable a flawed memory read (8 bytes) via a read access after the object is freed. The issue is in the ARM64 KVM coalesced_mmio code path and Trace shows a use-after...

CVE-2021-47512

The CVE-2021-47512 issue affects the Linux kernel’s net/sched fq_pie/Qdisc handling. fq_pie_destroy() failed to copy logic from pie_destroy() and related qdiscs, risking a timer rearm during del_timer_sync(&q->adapt_timer) and potentially triggering an rcu stall or related instability. The pro...

CVE-2022-48657

CVE-2022-48657 is a Linux kernel vulnerability affecting the arm64 topology code. The root cause is an overflow risk in amu_fie_setup due to cpufreq_get_hw_max_freq() returning the max frequency in kHz as an unsigned int, while freq_inv_set_max_ratio() expects that value in Hz as a 64-bit type. M...

CVE-2022-48718

CVE-2022-48718 concerns a NULL pointer dereference in the Linux kernel’s drm mxsfb driver. The vulnerability arises when drm_atomic_get_new_bridge_state can return a NULL pointer, which mxsfb may dereference. A fix was implemented that avoids dereferencing a NULL by assuming a fixed format instea...

CVE-2022-48745

The CVE-2022-48745 entry refers to a Linux kernel vulnerability in the net/mlx5 component where a race condition can occur due to del_timer() usage during the fw reset polling flow. The affected code substitutes del_timer() with del_timer_sync() to avoid deactivation of a timer while its interrup...

CVE-2022-48787

The CVE-2022-48787 vulnerability concerns iwlwifi use-after-free in the Linux kernel. When no firmware is present or parsing fails, device_release_driver()/remove()/iwl_drv_stop() may free the drv struct, but the code can still access it. The fix involves avoiding the access after the object is f...

CVE-2022-48811

CVE-2022-48811 concerns the ibmvnic driver in the Linux kernel. Affected: ibmvnic_open/reset paths in the IBM Power virtualization NIC stack. Root cause: in __ibmvnic_open(), if an error occurs (e.g., when setting link state), release_resources() frees napi structures that are still needed, causi...

CVE-2022-48861

CVE-2022-48861 is a Linux kernel use-after-free vulnerability in the vdpa/vp_vdpa path. When the vp_vdpa driver is unbound, vp_vdpa is freed in vdpa_unregister_device, after which vp_vdpa->mdev.pci_dev is dereferenced in vp_modern_remove, causing a use-after-free. The provided call traces show...

CVE-2022-48925

CVE-2022-48925 affects the Linux kernel RDMA/CMA path. The issue arises when the state is not idle: resolve_prepare_src() may overwrite route.addr.src_addr, potentially corrupting the source address and triggering a use-after-free trace in cma_cancel_listens() paths. The bug can occur with states...