CVE-2025-38489

CVE-2025-38489: In the Linux kernel (s390/BPF), the on-disk description notes that bpf_arch_text_poke() with new_addr == NULL caused intermittent panics; the fix re‑instates the previously removed correction from commit c730fce7c70c, restoring the intended behavior and adding a clarifying comment...

CVE-1999-0381

CVE-1999-0381 affects the syslog utility in super 3.11.6 and other versions, where a buffer overflow allows a local user to gain root privileges. The issue originates from the syslog component, with the impact described as local privilege escalation (root). Available connected documents confirm t...

CVE-2004-0181

The CVE-2004-0181 issue is an information leak in the Linux 2.4.x JFS code where in-memory data could be written to the device, allowing a local user to read sensitive information from the raw device. The relevant connected advisories (RHSA-2005:663, CentOS/CESA-2005:663) document this flaw as ad...

CVE-2004-1016

CVE-2004-1016 affects the Linux kernel (2.4.x up to 2.4.28 and 2.6.x up to 2.6.9) where the scm_send function in the kernel SCM layer can be triggered by local users. By crafting auxiliary messages passed to sendmsg, this can lead to a deadlock and a system hang (denial of service). Public record...

CVE-2005-2555

CVE-2005-2555 affects the Linux kernel 2.6.x line. The issue is that socket policy access is not properly restricted to users with the CAP_NET_ADMIN capability, potentially allowing local users to perform unauthorized activities. The vulnerability is associated with the IPv4 and IPv6 socket glue ...

CVE-2005-3806

CVE-2005-3806 affects Linux kernels 2.4 (up to 2.4.32) and 2.6 (before 2.6.14); IPv6 flow label handling in ip6_flowlabel.c may modify the wrong variable, enabling local attackers to corrupt kernel memory or trigger a crash by freeing non-allocated memory. Connected advisories (Debian DSA-1018-1/...

CVE-2006-0038

The CVE-2006-0038 issue is a local kernel vulnerability in Linux 2.6.x where arithmetic in netfilter’s do_replace() can overflow a buffer. Exploitation requires CAP_NET_ADMIN rights and is tied to virtualization environments (e.g., OpenVZ). The advisory notes that this can lead to arbitrary code ...

CVE-2006-0742

CVE-2006-0742 affects the Linux kernel on IA-64 (Itanium) where the die_if_kernel function in arch/ia64/kernel/unaligned.c is compiled with the noreturn attribute. In kernels 2.6.x before 2.6.15.6, this can allow local users to trigger user faults that lead to a denial of service. The root cause ...

CVE-2006-1856

CVE-2006-1856 is a confirmed issue in the Linux kernel up to 2.6.8 where the readv and writev LSM hooks could be bypassed due to a missing file_permission check. The Debian advisory DSA-1184-2 and related distributions (e.g., Ubuntu USN-302-1) document this as one of several vulnerabilities fixed...

CVE-2006-1858

CVE-2006-1858 affects the Linux kernel SCTP chunk length handling. The vulnerability arises when a chunk length is inconsistent with the actual parameters, enabling remote attackers to trigger a crash and potentially execute arbitrary code. Connected advisories show mitigations via kernel securit...

CVE-2006-2448

Concrete details found: CVE-2006-2448 affects the Linux kernel on PowerPC, specifically versions before 2.6.16.21 and 2.6.17. The root cause is missing access_ok checks in PowerPC signal handling (signal_64.c, potentially signal_32.c). Impact as stated: local users could read arbitrary kernel mem...

CVE-2006-2936

CVE-2006-2936 affects the ftdi_sio USB/serial driver in Linux kernels 2.6.x (up to at least 2.6.17). The issue lets local users trigger memory consumption DoS by writing more data to a serial port than the hardware can handle, causing queued data and potential resource exhaustion. Public referenc...

CVE-2006-4535

CVE-2006-4535 describes a local denial-of-service in the Linux kernel SCTP implementation where a socket with a specific SO_LINGER value can crash the kernel. Affected are kernel versions 2.6.17.10, 2.6.17.11 and 2.6.18-rc5 (and older kernels backported CVE-2006-3745 patches). Public sources (Red...

CVE-2006-4623

The vulnerability CVE-2006-4623 affects the Linux kernel DVB ULE decapsulation path: Unidirectional Lightweight Encapsulation (ULE) in dvb-core/dvb_net.c of the kernel 2.6.17.8. A remote attacker can cause a denial of service (crash) by sending a ULE packet with an SNDU length of 0. Public adviso...

CVE-2006-5753

The CVE-2006-5753 issue concerns the Linux kernel: a flaw in the listxattr system call that can be exploited when a bad inode is present. Local users may cause a denial of service (data corruption) and potentially escalate privileges. Supported documents indicate this vulnerability was addressed ...

CVE-2007-2764

The CVE-2007-2764 entry concerns the embedded Linux kernel in certain Sun-Brocade SilkWorm switches prior to 20070516. The issue arises when a non-root user creates a kernel process, which can lead to a denial of service (kernel oops) and device reboot via unspecified vectors. The NVD entry assig...

CVE-2007-4133

CVE-2007-4133 affects the Linux kernel prior to 2.6.19-rc4. The vulnerability lies in the hugetlbfs code: the functions hugetlb_vmtruncate_list and hugetlb_vmtruncate in fs/hugetlbfs/inode.c perform prio_tree calculations using HPAGE_SIZE instead of PAGE_SIZE units, enabling a local user to trigg...

CVE-2009-0859

CVE-2009-0859 affects the Linux kernel shm subsystem (ipc/shm.c). When CONFIG_SHMEM is disabled, shm_get_stat misinterprets the inode data type, enabling local users to trigger a denial of service (system hang) via an SHM_INFO shmctl call (as demonstrated by the ipcs program). The advisory notes ...

CVE-2009-3640

CVE-2009-3640 affects the Linux kernel KVM component (arch/x86/kvm/x86.c). The update_cr8_intercept function does not properly handle missing APIC, causing a local denial of service via a NULL pointer dereference and, potentially, privilege escalation through kvm_vcpu_ioctl. Affected: kernels bef...

CVE-2010-0741

CVE-2010-0741 affects the Linux kernel in the virtio-net driver when used with qemu-kvm 0.11.0 or KVM, allowing a remote attacker to crash the guest OS by sending a large volume of TCP traffic due to an improper TCP Segment Offloading (TSO) handling in virtio-net. The issue is triggered by a flaw...

CVE-2010-4343

CVE-2010-4343 affects the Linux kernel, where drivers/scsi/bfa/bfa_core.c may fail to initialize a port data structure in fc_host, enabling a local user to crash the system by reading the fc_host statistics file. This is fixed in kernel versions starting with 2.6.35 (i.e., patched in 2.6.35+). Ev...

CVE-2011-2695

CVE-2011-2695 involves multiple off-by-one errors in the Linux kernel ext4 subsystem (before 3.0-rc5). Local users can cause a denial of service (BUG_ON and system crash) by performing a write operation to a sparse file in extent format where the block number equals the maximum 32-bit unsigned va...

CVE-2012-6539

CVE-2012-6539: In Linux kernel prior to 3.6, dev_ifconf in net/socket.c fails to initialize a structure, allowing local attackers to read kernel stack memory. SUSE advisories (SUSE-SU-2014:0536-1) roll up fixes and list this CVE among many kernel mitigations; patching/upgrading to kernel 3.6+ is ...

CVE-2013-2898

The CVE-2013-2898 entry concerns the Linux kernel HID subsystem, specifically drivers/hid/hid-sensor-hub.c. When CONFIG_HID_SENSOR_HUB is enabled, the vulnerability affects the kernel up through version 3.11 and allows physically proximate attackers to obtain sensitive information from kernel mem...

CVE-2013-7026

Summary of CVE-2013-7026 : The Linux kernel contains race conditions in ipc/shm.c (IPC_SHM with IPC_RMID) that can be exploited locally to trigger use-after-free and a system crash, potentially causing a denial of service. The issue affects kernels prior to 3.12.2. The referenced advisories indic...

CVE-2014-8480

CVE-2014-8480 affects the Linux kernel KVM subsystem: the instruction decoder in arch/x86/kvm/emulate.c lacks intended decoder-table flags for certain RIP-relative instructions. This can allow a guest OS user to trigger a NULL pointer dereference and crash the host OS (denial of service). The vul...

CVE-2014-9717

Vulnerability CVE-2014-9717 affects the Linux kernel prior to 4.0.2. The flaw is in fs/namespace.c where unmounting (MNT_DETACH) is processed by umount2 without ensuring MNT_LOCKED is unset, allowing local users to bypass access restrictions and access beneath a mount when running in a user names...

CVE-2016-2068

The CVE-2016-2068 issue affects the MSM QDSP6 (sound) driver in the Linux kernel 3.x, used in Qualcomm QuIC Android contributions. The vulnerability arises in the driver when handling AUDIO_EFFECTS_WRITE (or AUDIO_EFFECTS_READ) operations, due to integer overflow and potential buffer overflow or ...

CVE-2017-9984

The CVE-2017-9984 issue affects the Linux kernel’s snd_msnd_interrupt path (sound/isa/msnd/msnd_pinnacle.c) and is a local, double-fetch vulnerability that can allow over-boundary access to a message queue head pointer, potentially enabling DoS or other impact. The advisory notes vulnerable until...

CVE-2021-47147

CVE-2021-47147 affects the Linux kernel (ptp: ocp). The issue is a resource leak in an error path after a successful pci_ioremap_bar() unless a corresponding pci_iounmap() is invoked, as implemented in the remove path. The connected documents confirm the vulnerability and its fix in the kernel, w...

CVE-2021-47193

CVE-2021-47193 affects the Linux kernel SCSI PM80XX driver (pm80xx) where memory allocated by the module is not fully freed on rmmod, causing a memory leak during driver removal. The vulnerability is resolved in Linux kernel code by properly freeing memory when the module is removed. The CVE has ...

CVE-2021-47415

CVE-2021-47415 affects the Linux kernel’s iwlwifi mvm code. The vulnerability is a potential NULL pointer dereference in __iwl_mvm_remove_time_event(), mitigated by checking te_data->vif for NULL before dereferencing. The issue is resolved by the kernel patch referenced in the initial descript...

CVE-2021-47591

CVE-2021-47591 affects the Linux kernel. The vulnerability arises from the TCP_ULP setsockopt mechanism, which is no longer supported for MPTCP as it is already used internally to connect subflow sockets to the MPTCP layer. In syzbot testing, a crash (KASAN null dereference) was observed on mptcp...

CVE-2021-47669

In the provided materials, CVE-2021-47669 is tied to the Linux kernel, specifically a use-after-free condition in the vxcan_xmit path of can: vxcan. After calling netif_rx_ni(skb), the code may dereference skb, and the canfd_frame cfd that aliases skb memory can be accessed post-netif_rx_ni, lead...

CVE-2022-48639

CVE-2022-48639 involves a refcount leak in Linux kernel net: sched tc_new_tfilter(). The fix requires tfilter_put to release the refcount obtained from tp->ops->get when chain->tmplt_ops is non-NULL and differs from tp->ops. Connected sources confirm the vulnerability exists in the Li...

CVE-2022-48640

The CVE-2022-48640 entry documents a NULL dereference in the Linux kernel bonding subsystem. Root cause: when a bond is created with an initial mode other than Round Robin (mode != 0), the memory for the bonding.rr_tx_counter is not allocated, so switching modes later does not verify allocation, ...

CVE-2022-48660

CVE-2022-48660 is a Linux kernel vulnerability affecting gpiolib: cdev on certain platforms (ex: nxp-ls1028). The issue occurred when the IRQ for lineevent_state was set before the IRQ was successfully registered, leading to a warning trace from free_irq() during gpio tests and a resource release...

CVE-2022-48783

CVE-2022-48783 affects the Linux kernel net: dsa lantiq_gswip driver. The issue is a use-after-free in gswip_remove() where of_node_put(priv->ds->slave_mii_bus->dev.of_node) must be done before mdiobus_free(priv->ds->slave_mii_bus). Connected documentation provides the exact remedi...

CVE-2022-48785

The CVE-2022-48785 issue in the Linux kernel concerns ipv6: mcast path where ipv6_get_lladdr() was switched to __ipv6_get_lladdr(), an RCUnsafe variant, after external locks were removed in mld updates. The description notes this is only safe when idev->lock is held for those code paths, but w...

CVE-2022-48844

The CVE-2022-48844 entry refers to a Linux kernel Bluetooth issue in the hci_core subsystem: sent_cmd memory is leaked when freeing hci_dev, causing a memory leak. This is a local, low-privilege exposure with high availability impact as per the CVSS data. Connected advisories confirm a fixed fix ...

CVE-2022-48848

CVE-2022-48848 affects the Linux kernel tracing/osnoise workflow. Concrete detail: the issue is caused by unregistering tracepoints twice when stopping tracing (osnoise_workload_stop) and switching tracer to nop, leading to a kernel warning about unregistering an unregistered tracepoint. The conn...

CVE-2022-48930

CVE-2022-48930 corresponds to a deadlock in the Linux kernel RDMA/ib_srp path. The fix removes the flush_workqueue(system_long_wq) call, which was deadlock‑prone and redundant with a preceding cancel_work_sync(). The associated Nessus entries reproduce the advisory text and reference kernel-stabl...

CVE-2022-49064

CVE-2022-49064 affects the Linux kernel's cachefiles code. The issue is an in-use flag leakage in error paths: in cachefiles_open_file(), an in-use flag could leak and cause the system to log “Inode already in use” on subsequent lookups; in cachefiles_create_tmpfile() this leakage could occur wit...

CVE-2022-49172

Summary: CVE-2022-49172 pertains to the Linux kernel parisc line. The root cause was non-access data TLB faults from flush_user_dcache_range_asm and flush_user_icache_range_asm when pages are not present, leading to cache lines not being invalidated and potential memory corruption. Impact details...

CVE-2022-49184

The CVE-2022-49184 issue affects the Linux kernel under net: sparx5: switchdev, where a NULL pointer dereference could occur if devm_kzalloc() returns NULL and the code dereferences the pointer. The description across connected sources indicates the vulnerability was resolved in the Linux kernel ...

CVE-2022-49278

CVE-2022-49278: Linux kernel remoteproc vulnerability in rproc_coredump_write() where a count underflow was possible. The fix adds a count check for zero, mirroring the validation in rproc_recovery_write(), to prevent underflow. This is resolved in the kernel codebase; patch references are in the...

CVE-2022-49624

Summary (CVE-2022-49624) The Linux kernel Atlantic/AQ NIC driver had a bug where aq_nic_deinit() could be invoked again during resume after suspend, causing a hang on resume from S3. The fix removes aq_nic_deinit() during resume so it is not called again. This vulnerability affects the Atlantic n...

CVE-2022-49797

CVE-2022-49797 concerns the Linux kernel tracing subsystem. The vulnerability is a potential NULL pointer dereference in the kprobe path: when trace_get_event_file() fails, gen_kretprobe_test may be marked as the error code, and if the kprobe_event_gen_test module is removed, a dereference can oc...

CVE-2022-49830

CVE-2022-49830 affects the Linux kernel’s DRM subsystem. The issue occurs in drm_dev_init(), which adds drm_dev_init_release() as a callback; if drmm_add_action() fails, the release callback isn’t registered, causing the refcnt from device_get() in drm_dev_init() to leak instead of being released...

CVE-2022-49869

CVE-2022-49869 (bnxt_en): In the Linux kernel bnxt_hwrm_set_coal() may crash during error recovery because rtnl_lock isn’t held for the entire sequence, allowing freed datastructures. The fix uses BNXT_STATE_OPEN rather than netif_running() to ensure the device is fully operational before reconfi...