CVE-2007-6716

CVE-2007-6716 affects the Linux kernel before 2.6.23, where in the dio subsystem the file system’s direct-io path (fs/direct-io.c) may fail to zero out the dio struct. This can allow a local user to cause a denial of service (OOPS), as demonstrated by a fio test. The connected documents confirm t...

CVE-2022-50127

CVE-2022-50127 affects the Linux kernel RDMA/rxe path. The vulnerability occurs in rxe_create_qp() where rxe_qp_from_init() initializes qp before spinlocks are set up (before rxe_qp_init_req()). If an error happens prior to the proper initialization, an unwind path calls rxe_cleanup()/rxe_qp_do_c...

CVE-2022-50168

CVE-2022-50168 (Linux kernel) : A race/cleanup bug in BPF JIT on x86 allowed freeing of a not-finalized bpf_prog_pack, triggered when multiple subprogs are processed. The root cause was that jit_subprogs() could free subprograms before bpf_jit_binary_pack_finalize() had run for them, risking free...

CVE-2023-52505

CVE-2023-52505 affects the Linux kernel driver for lynx-28g PHYs. The issue arises when concurrent phy_set_mode_ext() calls target PCC-related protocol-converter registers (PCC8, PCCC, PCCD) across multiple lanes, risking hardware register corruption because lynx_28g_rmw() lacked locking. The fix...

CVE-2023-52570

CVE-2023-52570 affects the Linux kernel vfio/mdev path. The vulnerability is a NULL pointer dereference that can occur in mdev_unregister_parent() during module removal of the mdpy.mdpy (mdpy.ko), traced to probing/initialization flow (kobject_add_internal/kobject_init_and_add) and mdev_type_add(...

CVE-2024-38551

CVE-2024-38551 : In the Linux kernel, the ASoC Mediatek path assigns a dummy codec to a DAI link if no real codec is present, to avoid NULL pointer errors during string comparisons. This vulnerability was resolved by the kernel fix described in the initial document, with MediaTek sound card drive...

CVE-2024-38563

CVE-2024-38563 affects the Linux kernel wifi driver for the MT76 MT7996. When reading the chip temperature, a memory leak could occur prior to the fix. The issue is resolved by a kernel commit that patches the MT7996 temperature-reading path; details are in the vendor/kernel advisories and linked...

CVE-2024-38592

CVE-2024-38592 affects the Linux kernel’s Mediatek DRM driver (drm/mediatek). The issue stems from a ddp_comp array being allocated with devm_kcalloc(), but when conn_routes is true an extra slot can go uninitialized, leading to a crash while mtk_drm_crtc_mode_valid() iterates the array. Repro wa...

CVE-2024-39470

CVE-2024-39470 : In the Linux kernel, a null-pointer dereference could occur in eventfs_find_events() when ei is NULL after update_events_attr, potentially leading to a crash if ei->is_freed is set. The issue has been resolved via kernel patches (stable releases) implementing a guard that retu...

CVE-2024-42099

The CVE-2024-42099 issue affects the Linux kernel on s390/dasd, where an invalid dereferencing of the indirect CCW data pointer (IDAW) could trigger a kernel panic in error paths. The root cause is that the CCW CDA pointer points to the IDAL, not directly to the data address, requiring translatio...

CVE-2024-46790

CVE-2024-46790 concerns the Linux kernel: when freeing PG_hwpoison pages they are isolated rather than released, leading to a warning: “alloc_tag was not set.” The Astra Linux bulletin confirms the issue and states the fix is to “clear the page tag reference after the page got isolated and accoun...

CVE-2024-56554

CVE-2024-56554: Linux kernel binder use-after-free due to freeze work left queued when cleaning up a binder reference. The issue occurs when a reference is freed while ref->freeze.work remains queued in the process workqueue, triggering KASAN slab-use-after-free in binder_release_work. A patch...

CVE-2024-57891

The CVE refers to a Linux kernel issue fixed in the sched_ext subsystem: an invalid IRQ restore could occur due to improper conversion of an inner rq_unlock_irqrestore() to rq_unlock() when adding outer irqsave/restore locking in scx_ops_bypass(). This could lead to the IRQs being re-enabled at a...

CVE-2025-21860

The CVE-2025-21860 entry relates to a Linux kernel zswap bug in which inconsistent accounting occurs when zswap_store_page() fails to swap an entire folio after some base pages were swapped. The root cause was skipping charging zswap entries on failed swaps, which could lead to uncharged entries ...

CVE-2025-21900

CVE-2025-21900 : In the Linux kernel, a deadlock can occur in NFSv4 state recovery for a sillyrenamed file scheduled for delete-on-close, when a server reboot triggers an open reclaim and races with close(). The root cause is a synchronous delegreturn call from put_nfs_open_context() that isn’t m...

CVE-2025-37845

CVE-2025-37845: Linux kernel tracing fprobe events fix prevents use-after-free by unloading a module during tprobe/tracepoint handling. Root cause: a previous relocation of try_module_get() from __find_tracepoint_module_cb() to find_tracepoint() could access a freed module object; the patch resto...

CVE-2025-38138

CVE-2025-38138 concerns the Linux kernel TI DMA engine, specifically the ti udmaProbe path. The root cause is a NULL pointer dereference when devm_kasprintf() returns NULL due to memory allocation failure, because udma_probe() did not check this return value. The vulnerability is mitigated by a p...

CVE-2025-38303

The CVE-2025-38303 issue affects the Linux kernel Bluetooth path: eir_create_adv_data may add EIR_FLAGS and EIR_TX_POWER without validating that they fit, potentially causing a crash. The description states this vulnerability has been resolved in the kernel (fix for crashes in eir_create_adv_data...

CVE-2025-38323

Summary (CVE-2025-38323): In the Linux kernel, the ATM LECS code path (net/atm/lec.c) had a potential use-after-free due to a path that could leave a dangling pointer in dev_lec[] from lecd_attach(). The patch adds a mutex (lec_mutex) to protect dev_lecp[] uses from lecd_attach(), lec_vcc_attach(...

CVE-2025-38474

CVE-2025-38474 affects the Linux kernel USB Sierra network driver. The issue arises from not verifying that the driver’s third USB endpoint is an interrupt input, since the code only checked for three endpoints and bulk in/out. The fix “rectifies the omission” by validating the endpoint type. Ups...

CVE-2025-39764

The CVE-2025-39764 entry concerns a Linux kernel netfilter issue: ctnetlink path dumpers initially kept an expectation object alive via refcounting, risking a refcounting bug (double-increment) when exp == last, leading to a memory leak. The patch removes refcounting for the expectation object an...

CVE-2025-40300

The CVE-2025-40300 issue affects the Linux kernel’s x86/vmscape mitigation. The vulnerability arises from insufficient branch predictor isolation between a guest and a userspace hypervisor, which is mitigated by conditionally issuing an IBPB after VMexit and before returning to userspace. The fix...

CVE-2026-23074

CVE-2026-23074 is a Linux kernel vulnerability in net/sched teql where the teql queuing discipline may be used outside its intended root qdisc, allowing a crafted packet sequence to create a use-after-free scenario in the qfq/qos path due to queue length (qlen) handling. The root cause is that te...

CVE-2026-43406

CVE-2026-43406 affects the Linux kernel libceph component. The issue is in process_message_header() where, if a message frame is corrupted or misrepresented, an out-of-bounds read may occur due to a missing explicit bounds check before decoding the header. The vulnerability can enable remote expl...

CVE-2026-52999

CVE-2026-52999 pertains to the Linux kernel netfilter nfnetlink_osf, where an out-of-bounds read can occur during TCP option parsing when NF_OSF_LOGLEVEL_ALL is enabled. The root cause is a shared ctx->optp pointer that isn’t restored after nf_osf_match_one() returns, allowing subsequent finge...

CVE-2026-53216

The CVE-2026-53216 issue affects the Linux kernel mvpp2 XDP path. Short pool buffers can be smaller than PAGE_SIZE, yet XDP initially sets every xdp_buff frame size to PAGE_SIZE. The XDP helpers then use frame_sz to validate tail growth, which, with an oversized frame, can allow bpf_xdp_adjust_ta...

CVE-2026-53363

CVE-2026-53363 (Linux kernel xfrm/iptfs): The vulnerability arises because iptfs_consume_frags() does not propagate the SKBFL_SHARED_FRAG flag when transferring paged fragments, mirroring the flaw fixed in skb_try_coalesce() for CVE-2026-46300. As a result, ESP could make incorrect in-place encry...

CVE-2004-0178

The vulnerability lies in the Linux 2.4.x sb16 Sound Blaster driver (OSS) in 16-bit mode; under odd-sized samples it can crash local users. Affects Linux 2.4.x before 2.4.26. Remediation: upgrade to Linux 2.4.26 or newer.

CVE-2004-0814

CVE-2004-0814 describes race conditions in the Linux terminal layer (kernel 2.4.x and 2.6.x prior to 2.6.9). Root causes include a TIOCSETD ioctl race on a terminal interface accessed by multiple threads and a separate race when switching from console to PPP line discipline, which could allow loc...

CVE-2005-0504

CVE-2005-0504 is a buffer overflow in the MoxaDriverIoctl function of the MOXA serial driver (moxa.c) in Linux 2.2.x, 2.4.x, and 2.6.x prior to 2.6.22. This vulnerability could allow a local unprivileged user to execute arbitrary code via a modified length value. The CVE is referenced in multiple...

CVE-2006-4093

CVE-2006-4093 affects Linux kernel 2.x on PowerPC PPC970: HID0 attention enable at boot time can crash the kernel (denial of service). Vulnerable: 2.6.x up to 2.6.17.9 and 2.4.x up to 2.4.33.1. Exploitation details are not provided in the initial documents, but multiple advisories (e.g., RHSA, SU...

CVE-2007-5500

The CVE-2007-5500 issue is described in connected documents as a vulnerability in the Linux kernel (2.6.x) where the wait_task_stopped routine checks a TASK_TRACED bit instead of exit_state. This could allow a local unprivileged user to cause a denial of service (machine crash) via unspecified ve...

CVE-2009-3725

CVE-2009-3725 affects the Linux kernel prior to 2.6.31.5 and relates to the connector layer not requiring CAP_SYS_ADMIN for certain interactions with uvesafb, pohmelfs, dst, or dm, enabling local users to bypass access restrictions and escalate privileges. Public references corroborate a local-pr...

CVE-2010-1148

CVE-2010-1148 – Linux kernel vulnerability : The cifs_create function in fs/cifs/dir.c (affected in Linux kernel 2.6.33.2 and earlier) can be triggered by a POSIX file-creation request to a server that supports UNIX extensions when the nd field is a NULL nameidata. This can lead to a NULL pointer...

CVE-2010-2071

The CVE-2010-2071 entry corresponds to the Linux kernel issue where the btrfs_xattr_set_acl function in fs/btrfs/acl.c did not verify file ownership before applying ACLs. Affected: Linux kernel 2.6.34 and earlier. Impact: local users can bypass file permissions by setting arbitrary ACLs (demonstr...

CVE-2010-4650

The CVE-2010-4650 issue affects the Linux kernel’s fuse_do_ioctl in fs/fuse/file.c, where a buffer overflow could be exploited by a CUSE server to achieve local denial of service or potential other impact. Multiple connected sources confirm a fix in kernel 2.6.37 and note that exploitation requir...

CVE-2011-0463

CVE-2011-0463 affects the OCFS2 code path in the Linux kernel. The issue is in the function ocfs2_prepare_page_for_write where holes crossing page boundaries are not handled correctly, enabling a local user to read potentially sensitive data from uninitialized disk locations. The description indi...

CVE-2011-1581

CVE-2011-1581 affects the Linux kernel bonding driver (drivers/net/bonding/bond_main.c). When a network device with many receive queues is installed and the default tx_queues is used, the code fails to properly constrain queue indexes, enabling a remote attacker to cause a denial of service or sy...

CVE-2013-0310

The issue CVE-2013-0310 affects the Linux kernel, specifically the cipso_v4_validate function in net/ipv4/cipso_ipv4.c. In kernels prior to 3.4.8, local attackers can trigger a NULL pointer dereference and system crash via IPOPT_CIPSO IP_OPTIONS used with setsockopt, enabling potential local deni...

CVE-2013-2146

CVE-2013-2146 affects the Linux kernel (pre-3.8.9) in the x86 Perf Event subsystem. The vulnerable component is arch/x86/kernel/cpu/perf_event_intel.c, which uses an incorrect bitmask when the Performance Events Subsystem is enabled. Under this condition, a local user can trigger a denial of serv...

CVE-2013-2894

CVE-2013-2894 affects the Linux kernel HID subsystem, specifically drivers/hid/hid-lenovo-tpkbd.c. When CONFIG_HID_LENOVO_TPKBD is enabled, the vulnerability permits a physically proximate attacker to trigger a denial of service via a heap-based out-of-bounds write using a crafted USB device. The...

CVE-2013-3235

Mitigation-ready summary for CVE-2013-3235: In the Linux kernel, net/tipc/socket.c prior to 3.9-rc7 does not initialize a certain data structure and a length variable, enabling local attackers to read sensitive data from kernel stack memory via crafted recvmsg/recvfrom. Affected scenario is local...

CVE-2016-2383

The CVE-2016-2383 vulnerability affects the Linux kernel (kernel/bpf/verifier.c) where, in the backward-jump delta handling, local attackers can craft BPF instructions to read kernel memory. It is exploitable by local users via a crafted packet filter. The issue is present in kernel versions befo...

CVE-2017-0537

CVE-2017-0537 affects Android kernels with Kernel-3.18 and relates to the USB gadget driver. It enables a local attacker to disclose data outside their permissions after compromising a privileged process. Impact: partial confidentiality. No public fixes or remediation details are provided in the ...

CVE-2017-15128

The CVE-2017-15128 issue affects the Linux kernel’s hugetlb_mcopy_atomic_pte function (mm/hugetlb.c) prior to version 4.13.12, where a missing size check can lead to a denial of service (BUG). Public sources in connected advisories (e.g., EulerOS/Unity Linux Nessus plugins) corroborate that vulne...

CVE-2020-27784

CVE-2020-27784 is a use-after-free in the Linux kernel’s printer_ioctl path. The issue arises from accessing a deallocated printer_dev instance after it has been freed by gprinter_free(), enabling a local attacker to trigger a fault in the kernel. The vulnerability is tracked with CVSSv3.1 vector...

CVE-2021-4218

CVE-2021-4218 concerns a flaw in the Linux kernel related to reading the SVC RDMA counters. The vulnerability occurs when a local attacker with access triggers reading the counter via a sysctl, which panics the system and can cause a denial of service during reboot. The issue is described as spec...

CVE-2021-47121

Rejected: CVE-2021-47121 entry withdrawn/not used; this CVE is not an active vulnerability entry.

CVE-2021-47190

Concrete details from the connected docs show CVE-2021-47190 affects the Linux kernel’s perf/bpf path. The issue is a memory leak in perf_env__insert_btf() when a duplicate BTF id is encountered; code was changed to have perf_env__insert_btf() return a success/error value and to free memory if in...

CVE-2021-47240

The CVE-2021-47240 issue affects the Linux kernel’s net: qrtr subsystem, specifically the qrtr_endpoint_post path. Syzbot reported a slab-out-of-bounds Read due to a faulty size handling: if size from qrtr_hdr is 0xfffffffd, ALIGN(size,4) becomes 0, and a read skb_put_data(skb, data + hdrlen, siz...