CVE-2025-38153

CVE-2025-38153 (Linux kernel) is documented in connected sources as a vulnerability in the aqc111 USB network driver. The issue arises from incomplete sanitation of usbnet read results, where usbnet_read_cmd() may return fewer bytes than expected and aqc111_read_cmd() may not validate the result,...

CVE-2025-21983

CVE-2025-21983 describes a Linux kernel vulnerability where kvfree_rcu used the system_unbound_wq workqueue, potentially triggering a warning in nvme/scsi workflows due to flush_dependency checks. The mitigation documented in the sources is to switch kvfree_rcu to an independent WQ_MEM_RECLAIM wo...

CVE-2025-37779

CVE-2025-37779 concerns the Linux kernel’s lib/iov_iter.c and arises from an incorrect refcount fix for non-slab folio pages used in EROFS/v9fs p9 read paths. The root cause is that pages in a bvec can be coalesced across folio boundaries, and the non-slab folio refcount was not increased suffici...

CVE-2025-38099

CVE-2025-38099 : In the Linux kernel, a SCO Bluetooth connection could lock up the controller if voice settings are not properly read or supported. SUSE/OpenSUSE advisories (e.g., openSUSE-SU-2025-20081-1) list CVE-2025-38099 among fixed kernel vulnerabilities with MEDIUM/LOW to HIGH impact range...

CVE-2025-38120

Technical details about CVE-2025-38120 are not publicly available in the provided documents; the description notes a nf_set_pipapo_avx2 fix for initial map fill and a test addition, but no vendor/product specifics are given.

CVE-2025-38238

The CVE-2025-38238 issue affects the Linux kernel SCSI fnic driver, where a crash could occur when both FDMI RHBA and RPA requests time out and a frame is reused to send ABTS, leading to a double-free on completion. The fix allocates separate frames for RHBA and RPA and updates the ABTS handling ...

CVE-2025-38323

Summary (CVE-2025-38323): In the Linux kernel, the ATM LECS code path (net/atm/lec.c) had a potential use-after-free due to a path that could leave a dangling pointer in dev_lec[] from lecd_attach(). The patch adds a mutex (lec_mutex) to protect dev_lecp[] uses from lecd_attach(), lec_vcc_attach(...

CVE-2025-38389

CVE-2025-38389 affects the Linux kernel i915 DRM stack (drm/i915/gt). The vulnerability arises when ring submission allocation fails during VMA allocation, leaving the engine’s legacy timeline referenced and not released on driver unbind, potentially causing a left-held timeline and related insta...

CVE-2025-38418

CVE-2025-38418 affects the Linux kernel remoteproc subsystem. The root cause is a failure path in rproc_attach() where, if rproc_handle_resources() fails while the remote processor is in state RPROC_DETACHED, rproc->clean_table is not released, leading to a memory leak (observed in a kworker t...

CVE-2025-38426

Technical details about CVE-2025-38426 are not provided in the supplied documents. Open items reference the issue at a high level; monitor for updates from the OSV/OpenVAS/Tenable sources for concrete affected components, root cause, and fixes.

CVE-2025-38439

CVE-2025-38439 (bnxt_en, Linux kernel): Affects the bnxt_en driver when transmitting XDP_REDIRECT packets. The underlying bug was that dma_unmap_len_set() was called with length 0 instead of the actual length, triggering a warning under IOMMU-enabled systems (warning shown in kernel stack trace)....

CVE-2026-23274

CVE-2026-23274 : In the Linux kernel, a bug in netfilter xt_IDLETIMER allows rev0 rules to reuse timers labeled as ALARM if a prior timer exists. This can cause mod_timer() to run on an uninitialized timer_list, triggering debug warnings and potentially a panic when panic_on_warn=1. The fix rejec...

CVE-2004-1056

CVE-2004-1056 involves the Direct Rendering Manager (DRM) drivers in Linux kernel 2.6. It is caused by insufficient DMA lock checking, which could allow an authorized client to send arbitrary values to the video card, potentially causing an X server crash or modifying the video output. The vulner...

CVE-2004-1068

CVE-2004-1068 involves a missing serialization flaw in the unix_dgram_recvmsg path of Linux kernels 2.4.27 and earlier, and 2.6.x up to 2.6.9. The issue enables local users to potentially gain privileges due to a race condition. The description explicitly states the vulnerability is a local privi...

CVE-2005-0209

CVE-2005-0209 is a Linux kernel netfilter fragmentation flaw that allows a remote attacker to crash the system (DoS) by sending crafted IP fragments. Documented impact is a kernel crash via malformed fragments in the netfilter path of Linux 2.6.x (notably 2.6.8.1). Public advisories confirm vulne...

CVE-2005-1762

CVE-2005-1762 affects AMD64 Linux kernel 2.6.8.1 and 2.6.10; a ptrace() address verification flaw allows local users to crash the kernel (denial of service). Root cause: inadequate verification of non-canonical addresses in amd64 ptrace. Impact: kernel crash; exploitation requires local access. R...

CVE-2005-3273

CVE-2005-3273 affects the ROSE (rose) packet router ioctl in the Linux kernel (ROSE code in rose_route.c) for 2.6 kernels before 2.6.12 and 2.4 before 2.4.29. The root cause is improper verification of the ndigis argument when creating a new route, which can trigger array out-of-bounds conditions...

CVE-2005-3356

CVE-2005-3356 is a kernel vulnerability in Linux 2.6.x where the mq_open system call can be tricked into decrementing an internal counter twice, potentially leading to a kernel panic and local denial of service. The connected documents describe the root cause as a faulty sequence in mntput/dentry...

CVE-2006-1528

CVE-2006-1528 affects the Linux kernel prior to 2.6.13. The vulnerability arises in the sg (SCSI generic) driver’s handling of memory-mapped I/O space during a dio transfer, allowing a local user to trigger a crash ( Denial of Service ). The connected documents confirm the issue is located in the...

CVE-2006-2071

CVE-2006-2071 affects Linux kernels 2.4.x and 2.6.x up to 2.6.16. It arises from a flaw in the mprotect handling that allowed a local user to grant write permission to a read-only attachment of a shared memory segment, bypassing IPC permissions and enabling modification of the attachment. Reporte...

CVE-2007-1217

CVE-2007-1217 affects the ISDN CAPI subsystem in Linux kernel 2.6.9–2.6.20 and isdn4k-utils. A buffer overflow in capiutil.c’s bufprint function could allow a local user to crash the system and potentially gain privileges via a crafted CAPI packet. Exploitation requires ISDN frame access to the t...

CVE-2008-5702

CVE-2008-5702 concerns a buffer underflow in the Linux kernel watchdog driver IB700 SBC (ib700wdt.c) via the ibwdt_ioctl path. Affected software is the Linux kernel prior to 2.6.28-rc1; exploitation could occur through a WDIOC_SETTIMEOUT ioctl on /dev/watchdog by a local user. The Initial Descrip...

CVE-2010-1641

CVE-2010-1641 affects the Linux kernel’s gfs2 file operations. MiracleLinux AXSA-2010-377:12 notes the affected kernel (2.6.18-194.3.AXS3) and flags that do_gfs2_set_flags does not verify file ownership, allowing local bypass via a SETFLAGS ioctl. The vulnerability corresponds to Linux kernels be...

CVE-2011-1169

CVE-2011-1169 affects the Linux kernel before 2.6.38.1 via an array index error in the AudioScience HPI driver (sound/pci/asihpi/hpioctl.c) that can memory-corrupt local kernel data and may allow local privilege escalation. Connected advisories (SUSE/Ubuntu) confirm the root cause and impact, wit...

CVE-2011-2184

The CVE-2011-2184 entry concerns Linux kernel prior to 2.6.39.1 where key_replace_session_keyring fails to initialize a structure member, enabling local users to trigger a NULL pointer dereference and system crash via KEYCTL_SESSION_TO_PARENT in keyctl. This is a distinct issue from CVE-2010-2960...

CVE-2011-4594

The CVE-2011-4594 entry documents a local kernel vulnerability in the Linux kernel (__sys_sendmsg in net/socket.c) where crafted usage of sendmmsg can trigger an incorrect pointer dereference and crash the system. It affects kernel versions before 3.1, with the described impact being a denial of ...

CVE-2012-3520

CVE-2012-3520 concerns the Netlink implementation in the Linux kernel prior to 3.2.30, where Netlink messages missing SCM_CREDENTIALS data could be spoofed by a local attacker via crafted messages (notably affecting services such as Avahi or NetworkManager). The vulnerability enables a local user...

CVE-2012-6546

CVE-2012-6546 affects the Linux kernel up to version 3.6, where the ATM implementation may not initialize certain structures. This allows local users to obtain sensitive information from kernel stack memory via a crafted application. Connected advisories (e.g., MiracleLinux AXSA entries) confirm ...

CVE-2013-0313

CVE-2013-0313 affects the Linux kernel: when EVM is enabled, the evm_update_evmxattr function in security/integrity/evm/evm_crypto.c in versions before 3.7.5 is vulnerable to a local-denial-of-service via an attempted removexattr operation on a sockfs inode, causing a NULL pointer dereference and...

CVE-2015-1339

CVE-2015-1339 affects the Linux kernel: memory leak in cuse_channel_release (fs/fuse/cuse.c) can be triggered by opening /dev/cuse many times, leading to local denial of service via memory consumption (unbounded memory use). The vulnerability is reported as present in kernel versions before 4.4. ...

CVE-2016-4440

The CVE-2016-4440 issue affects the Linux kernel (up to 4.6.3) in arch/x86/kvm/vmx.c where APICv on/off state is mishandled. This allows guest OS users to access direct host APIC MSRs via x2APIC, enabling potential host denial of service (crash) or arbitrary code execution. A fix exists in the up...

CVE-2016-5342

The CVE-2016-5342 entry describes a heap-based buffer overflow in the wcnss_wlan_write function of the Linux kernel 3.x wcnss_wlan driver (drivers/net/wireless/wcnss/wcnss_wlan.c) used in Qualcomm QuIC MSM Android contributions. An attacker could trigger a denial of service or potentially other i...

CVE-2017-9986

The CVE-2017-9986 issue affects the Linux kernel’s sound/oss/msnd_pinnacle.c: the intr function is vulnerable to a double-fetch scenario when the message queue head pointer is read between two kernel reads, up to kernel versions through 4.11.7. This local condition allows a unprivileged user to c...

CVE-2021-47141

CVE-2021-47141 affects the Linux kernel gve path and is caused by missing NULL checks when freeing IRQ vectors. Specifically, when freeing notification blocks, code indexes priv->msix_vectors, and a failure to allocate priv->msix_vectors (abort_with_msix_vectors) can lead to a NULL pointer ...

CVE-2021-47175

CVE-2021-47175: Linux kernel net/sched fq_pie OOB access in the traffic path (fq_pie_qdisc_enqueue). The issue manifests as slab-out-of-bounds read during packet enqueue, demonstrated by a kasan report when using tc with fq_pie. A fix was applied to the fq_pie path to prevent selecting an out-of-...

CVE-2021-47190

Concrete details from the connected docs show CVE-2021-47190 affects the Linux kernel’s perf/bpf path. The issue is a memory leak in perf_env__insert_btf() when a duplicate BTF id is encountered; code was changed to have perf_env__insert_btf() return a success/error value and to free memory if in...

CVE-2021-47198

CVE-2021-47198 affects the Linux kernel lpfc SCSI lpfc driver. The vulnerability arises when unloading the driver: NLP_REG_LOGIN_SEND is set in lpfc_reg_fab_ctrl_node() but not cleared on login completion, allowing a second call to lpfc_unreg_rpi() to operate with nlp_rpi = LPFC_RPI_ALLOW_ERROR a...

CVE-2021-47233

Summary of CVE-2021-47233 (Linux kernel): The issue is a NULL pointer dereference in regulator rt4801 when priv->enable_gpios is NULL, with devm_gpiod_get_array_optional possibly returning NULL if no GPIO is assigned. The vulnerability has been resolved in the Linux kernel; multiple advisories...

CVE-2021-47242

CVE-2021-47242 affects the Linux kernel and is tied to a fix for an issue in MPTCP subflow error reporting. The root cause was a soft lookup caused when subflow_error_report() attempted to acquire mptcp_data_lock across call paths that could already hold other locks, triggering a soft lockup unde...

CVE-2021-47263

CVE-2021-47263 is a Linux kernel issue in the gpio-wcd934x driver where a shift-out-of-bounds UBSAN error occurred due to using BIT(n-1) for pins 0–4, leading to an out-of-bounds shift in gpio-wcd934x.c:34:14. The vulnerability has been resolved by a patch to correct the bit-mask handling (pins 0...

CVE-2021-47341

CVE-2021-47341 concerns the Linux kernel KVM mmio path, where a use-after-free flaw in kvm_vm_ioctl_unregister_coalesced_mmio could enable a flawed memory read (8 bytes) via a read access after the object is freed. The issue is in the ARM64 KVM coalesced_mmio code path and Trace shows a use-after...

CVE-2021-47437

In CVE-2021-47437, the Linux kernel IIO ADIS16475 driver is affected by a deadlock during frequency setting. The issue arose from two deadlocks introduced by the patch: (1) adis_write_reg_16() path not fully unlocked, and (2) lock not released on the success path. A fix was applied in commit 39c0...

CVE-2021-47503

In CVE-2021-47503, the Linux kernel SCSI pm80xx driver has a fix: do not call scsi_remove_host() inside pm8001_alloc() because scsi_add_host() has not yet been called, which previously could crash with a NULL pointer dereference during device_del. The issue occurs in the pm8001_pci_probe flow lea...

CVE-2021-47512

The CVE-2021-47512 issue affects the Linux kernel’s net/sched fq_pie/Qdisc handling. fq_pie_destroy() failed to copy logic from pie_destroy() and related qdiscs, risking a timer rearm during del_timer_sync(&q->adapt_timer) and potentially triggering an rcu stall or related instability. The pro...

CVE-2021-47514

CVE-2021-47514 : In the Linux kernel, there is a vulnerability in the devlink netns refcount handling, specifically a leak in netns refcounts in devlink_nl_cmd_reload(). The root cause is that some error paths forgot to release a netns refcount during the devlink_reload() flow. The patch fixes th...

CVE-2022-48641

CVE-2022-48641 (Linux kernel) affects netfilter ebtables where a malformed blob can cause a memory leak. The fix corrected an incomplete patch that replaced a crash with a leak; the code path incorrectly embedded an assignment to ret in the conditional and this was not properly restored. Affected...

CVE-2022-48727

CVE-2022-48727 affects the Linux kernel KVM arm64 code. When exceptions other than IRQ occur, ESR_EL2 is updated; if an IRQ synchronises an SError, the vcpu ESR may become stale and ELR_EL2 could be corrupted, risking duplication of guest instructions. The fix ensures ARM_EXCEPTION_CODE() is chec...

CVE-2022-48768

CVE-2022-48768 concerns a memory‑leak in the Linux kernel tracing/histogram path. The issue arises where kstrdup() allocates memory but kfree() is not called on an error path, leaving the memory allocated for data->params[i] (p) potentially unreleased. The described fix is to free the allocate...

CVE-2022-48769

In CVE-2022-48769, the Linux kernel vulnerability concerns Apple x86 EFI runtime services. The issue stems from a call to QueryVariableInfo() (added with EFI 2.00) used at runtime, which could crash firmware on certain Apple machines when managing NVRAM variables. The mitigation described is to a...

CVE-2022-48770

CVE-2022-48770 affects the Linux kernel vulnerability in the BPF stack trace code: bpf_get_task_stack() could dereference NULL pt_regs because task_pt_regs() may return NULL for kernel threads on powerpc. The patch adds a NULL check on the return value of task_pt_regs() before inspecting the call...