CVE-2021-47306

CVE-2021-47306 pertains to the Linux kernel FDDI driver: in net: fddi: fza_probe, the private data fp of a netdev is used after a free_netdev() call, causing a use-after-free (UAF). The fix reorders cleanup by moving free_netdev() after the error handling message to prevent UAF. Multiple connecte...

CVE-2024-40926

CVE-2024-40926 affects the Linux kernel DRM Nouveau driver. The issue occurs when runtime PM resumes on headless cards that lack display hardware, where hpd_work and hpd_lock are left uninitialized and scheduling hpd_work triggers a BUG. The patch adds a headless flag to DRM and instructs the sys...

CVE-2024-41003

The CVE-2024-41003 entry concerns a Linux kernel BPF verifier bug: after a prior OR, line 19 triggers a REG INVARIANTS VIOLATION due to a corrupted fake_reg when reg_set_min_max is applied to a known-constant branch. The issue arises in the BPF subsystem’s handling of register invariants during a...

CVE-2024-42072

Summary of CVE-2024-42072 (Linux kernel, bpf may_goto with negative offset) The issue, reported through the Linux kernel, stems from two bugs exposed by a syzbot-facilitated bpf program: (1) the patching of may_goto when the offset is negative, which requires a different handling; and (2) a verif...

CVE-2024-49573

CVE-2024-49573 relates to the Linux kernel scheduler (sched/fair.c). The fix patches NEXT_BUDDY handling in pick_next_entity() by moving clear_buddies() before the delayed dequeue logic and ensuring no new next buddy starts as delayed. This addresses a WARN triggered by enabling NEXT_BUDDY, with ...

CVE-2024-56730

CVE-2024-56730: In the Linux kernel, a memory allocation failure in net/9p/usbg (trans_usbg.c) was fixed by correcting kzalloc() failure handling to return NULL instead of ERR_PTR. The issue was detected in linux-next (next-20241108, vanilla kernel) and could affect memory exhaustion scenarios. T...

CVE-2024-58084

The CVE-2024-58084 issue in the Linux kernel relates to the Qualcomm SC M firmware (qcom_scm) read barriers. The advisory notes a missing read barrier in qcom_scm_get_tzmem_pool() and that a write barrier was previously added in probe. Access from concurrent contexts could fetch a stale __scm val...

CVE-2025-21834

Summary (mode C): CVE-2025-21834 relates to the Linux kernel where a seccomp passthrough for uretprobe systemcalls was not filtered. When uretprobes are attached to processes in Docker, the retprobe can cause the traced process to segfault because the default seccomp filters block this kernel-int...

CVE-2025-38131

CVE-2025-38131 affects the Linux kernel coresight subsystem. The issue arises when enabling an active config via cscfg_csdev_enable_active_config() but the config could be deactivated via configfs/sysfs during unloading, potentially leading to use-after-free of config_desc after the module unload...

CVE-2025-38273

CVE-2025-38273 affects the Linux kernel TIPC net subsystem. The root cause was a refcount handling issue where get_net() could be invoked on a network namespace already being destroyed, triggering a use-after-free warning when a TIPC discovery timer fires during namespace cleanup. The fix replace...

CVE-2025-38310

CVE-2025-38310 refers to a Linux kernel vulnerability in seg6 where validation of nexthop addresses could read uninitialized memory if the provided length exceeded the actual data; the fix enforces that the provided length exactly matches the specified length. The connected advisories confirm the...

CVE-2025-38326

CVE-2025-38326: Linux kernel AOE driver vulnerability where aoe device rq_list isn’t cleaned on down, causing blk_mq_freeze_queue() to sleep and hang. Fix clears the rq_list before blk_mq_freeze_queue(). No exploitation details provided; remediation is the kernel fix.

CVE-2025-38427

Summary: CVE-2025-38427 in the Linux kernel fixes a framebuffer relocation bug where screen_info frames were tied to boot CPU addresses, not accounting for PCI host-bridge offsets. During boot, firmware may assign a different PCI memory offset, relocating PCI graphics framebuffer addresses. The k...

CVE-2025-38502

Technical details beyond the initial description are not provided in the connected documents; no explicit product/version, impact specifics, or remediation are present here. Monitor for updates.

CVE-2025-38515

CVE-2025-38515 concerns a race in the Linux kernel’s DRM scheduler. The description states a small race between drm/sched spsc_queue_push and the run-job worker, where spsc_queue_push may return not-first while the worker has idled due to the job count reaching zero. The consequence is that job s...

CVE-2025-38604

CVE-2025-38604 relates to the Linux kernel Wi‑Fi driver RTL818x (rtl8187). The root cause was that URBs were not killed before clearing the transmit status queue, allowing callbacks to access freed skbs and potentially triggering a NULL pointer dereference (kernel crash). The fix moves usb_kill_a...

CVE-2026-23209

CVE-2026-23209 is a Linux kernel macvlan bug. The issue occurs in macvlan when creating a new link with MACVLAN_MODE_SOURCE and MACVLAN_MACADDR_ADD/SET and the lower device already has a macvlan port, causing a use-after-free after a failed register_netdevice() in the create path. Upstream kernel...

CVE-2026-31682

CVE-2026-31682 affects the Linux kernel bridge implementation, where br_nd_send may parse non-linear ND options from ns->opt[]. The root cause is failure to linearize the skb before ND option parsing, risking reads past the buffer and potential memory exposure or crash. The fix is to linearize...

CVE-2026-31709

In the Linux kernel SMB client (cifsacl), CVE-2026-31709 arises from insufficient validation of a server-provided DACL when rewriting security descriptors. The fix extends structural validation to ensure the DACL header, size, and per-ACE bounds are checked before any rewrite paths (replace_sids_...

CVE-2026-43406

CVE-2026-43406 affects the Linux kernel libceph component. The issue is in process_message_header() where, if a message frame is corrupted or misrepresented, an out-of-bounds read may occur due to a missing explicit bounds check before decoding the header. The vulnerability can enable remote expl...

CVE-2026-46090

CVE-2026-46090 affects the Linux kernel ALSA aloop driver. A use-after-free in loopback_check_format() can occur when playback starts with parameters that no longer match a running capture stream, while a concurrent close may detach or free the runtime. The issue arises after a patch that moved t...

CVE-2026-52933

CVE-2026-52933 affects the Linux kernel’s io_uring/poll component. The root cause is a signed comparison in io_poll_get_ownership() where atomic_read(&req->poll_refs) is compared to IO_POLL_REF_BIAS; when IO_POLL_CANCEL_FLAG (BIT(31)) is set, the value becomes negative, causing the slowpath to...

CVE-2006-0742

CVE-2006-0742 affects the Linux kernel on IA-64 (Itanium) where the die_if_kernel function in arch/ia64/kernel/unaligned.c is compiled with the noreturn attribute. In kernels 2.6.x before 2.6.15.6, this can allow local users to trigger user faults that lead to a denial of service. The root cause ...

CVE-2006-1066

CVE-2006-1066 is tied to the Linux kernel prior to 2.6.16 on x86_64 with preemption enabled. The vulnerability allows a local attacker to trigger a denial of service (oops) by using multiple ptrace tasks performing single steps, which can cause corruption of the DEBUG_STACK stack during the do_de...

CVE-2006-1863

CVE-2006-1863 is a directory traversal vulnerability in CIFS on Linux 2.6.16 and earlier that allows a local user to escape chroot restrictions for an SMB-mounted filesystem via "..\" sequences. The issue is mitigated by applying a kernel update (e.g., as per ChangeLog-2.6.16.11). Mode: C (detail...

CVE-2006-3741

CVE-2006-3741 concerns the perfmonctl (sys_perfmonctl) system call in Linux kernels 2.4.x and 2.6.x prior to 2.6.18 on Itanium. The issue is an improper reference-count accounting for file descriptors, which can allow local users to exhaust file descriptors and cause a denial of service. The desc...

CVE-2007-0772

The CVE-2007-0772 entry applies to the Linux kernel 2.6.13 and earlier, with the issue fixed in 2.6.20.1. A crafted NFSACL 2 ACCESS request could trigger a free of an incorrect pointer, leading to a remote denial of service (oops). Affected versions before 2.6.20.1 are vulnerable; mitigation is t...

CVE-2007-1861

CVE-2007-1861 affects the Linux kernel prior to 2.6.20.8. The nl_fib_lookup function in net/ipv4/fib_frontend.c can be triggered by NETLINK_FIB_LOOKUP replies, causing infinite recursion and a stack overflow that leads to a kernel panic (denial of service). Open sources in the connected data conf...

CVE-2009-1360

CVE-2009-1360 affects the Linux kernel prior to 2.6.29 when Network Namespace Support (NET_NS) is enabled. The vulnerability lies in __inet6_check_established in net/ipv6/inet6_hashtables.c, where crafted IPv6 traffic can trigger a NULL pointer dereference, enabling remote denial of service (syst...

CVE-2010-1451

CVE-2010-1451 affects the SPARC build of the Linux kernel prior to 2.6.33, where TSB I-TLB load handling in arch/sparc/kernel/tsb.S fails to correctly obtain the _PAGE_EXEC_4U bit, resulting in an incompletely implemented non-executable stack. This could allow context-dependent local attackers to...

CVE-2010-2071

The CVE-2010-2071 entry corresponds to the Linux kernel issue where the btrfs_xattr_set_acl function in fs/btrfs/acl.c did not verify file ownership before applying ACLs. Affected: Linux kernel 2.6.34 and earlier. Impact: local users can bypass file permissions by setting arbitrary ACLs (demonstr...

CVE-2013-2894

CVE-2013-2894 affects the Linux kernel HID subsystem, specifically drivers/hid/hid-lenovo-tpkbd.c. When CONFIG_HID_LENOVO_TPKBD is enabled, the vulnerability permits a physically proximate attacker to trigger a denial of service via a heap-based out-of-bounds write using a crafted USB device. The...

CVE-2014-5045

CVE-2014-5045 – Linux kernel mountpoint_last bug (pre-3.15.8) Affected: Linux kernel versions prior to 3.15.8.Root cause: The mountpoint_last function in fs/namei.c does not properly maintain a reference count when unmount is used in conjunction with a symlink.Impact: Local users could cause deni...

CVE-2016-2383

The CVE-2016-2383 vulnerability affects the Linux kernel (kernel/bpf/verifier.c) where, in the backward-jump delta handling, local attackers can craft BPF instructions to read kernel memory. It is exploitable by local users via a crafted packet filter. The issue is present in kernel versions befo...

CVE-2017-0428

CVE-2017-0428 describes an elevation-of-privilege in the NVIDIA GPU driver that could allow a local malicious application to execute arbitrary code in kernel context on Android devices with Kernel-3.10. The Android entry notes an Android ID (A-32401526) and flags the issue as critical due to pote...

CVE-2018-1000028

CVE-2018-1000028 is a Linux kernel vulnerability affecting kernels released after commit bdcf0a423ea1 (examples: 4.15-rc4+, 4.14.8+, 4.9.76+, 4.4.111+). It describes an Incorrect Access Control flaw in the NFS server (nfsd) that can let remote attackers read or write files they should not access ...

CVE-2021-47215

CVE-2021-47215 affects the Linux kernel mlx5e net/kTLS RX resync flow. The vulnerability stems from list corruption in TLS contexts during RX resync handling, where entries could be moved while resync processing is incomplete. The fix guards these TLS context entries from movements until resync h...

CVE-2021-47240

The CVE-2021-47240 issue affects the Linux kernel’s net: qrtr subsystem, specifically the qrtr_endpoint_post path. Syzbot reported a slab-out-of-bounds Read due to a faulty size handling: if size from qrtr_hdr is 0xfffffffd, ALIGN(size,4) becomes 0, and a read skb_put_data(skb, data + hdrlen, siz...

CVE-2021-47294

The CVE-2021-47294 issue affects the Linux kernel NETROM implementation where sock timer handling changed to sock timer API. sk_reset_timer() may increase the sock refcount when called on an inactive timer, so if the timer expires the handler must decrease the refcount to avoid a leak. A patch (c...

CVE-2021-47367

Affected software: Linux kernel virtio-net component. Issue: when using build_skb() in big mode, unused pages chained via private in big mode were not released, causing page leakage. Root cause: failure to release those pages after skb construction in big mode. Impact: potential resource leak; CV...

CVE-2021-47604

CVE-2021-47604 concerns a Linux kernel vulnerability in vduse where get_config() failed to bound-check the offset, causing a potential out-of-bounds read when offset > dev->config_size due to unsigned subtraction. The issue is resolved in the Linux kernel (as per the description), with advi...

CVE-2022-48844

The CVE-2022-48844 entry refers to a Linux kernel Bluetooth issue in the hci_core subsystem: sent_cmd memory is leaked when freeing hci_dev, causing a memory leak. This is a local, low-privilege exposure with high availability impact as per the CVSS data. Connected advisories confirm a fixed fix ...

CVE-2022-48899

CVE-2022-48899 affects the Linux kernel DRM virtio GEM handle creation. The issue is a use-after-free (UAF) caused by racing GEM object creation with handle close, where the handle’s reference must be dropped only after dereferencing the object. This analysis is supported by multiple connected ad...

CVE-2022-48930

CVE-2022-48930 corresponds to a deadlock in the Linux kernel RDMA/ib_srp path. The fix removes the flush_workqueue(system_long_wq) call, which was deadlock‑prone and redundant with a preceding cancel_work_sync(). The associated Nessus entries reproduce the advisory text and reference kernel-stabl...

CVE-2022-48937

CVE-2022-48937 affects the Linux kernel io_uring subsystem, specifically a missing schedule point introduced in io_add_buffers. The vulnerability can cause soft lockups when a loop runs ~65,535 times performing kmalloc allocations, with DEBUG features (e.g., KASAN) enabled amplifying the issue. R...

CVE-2022-49127

CVE-2022-49127 is a Linux kernel vulnerability fix where the ref_tracker use-after-free detection was added. The patch marks the ref_tracker_dir as dead during ref_tracker_dir_init() and checks this dead status from ref_tracker_alloc() and ref_tracker_free(), aiming to detect buggy dev_put()/dev_...

CVE-2022-49225

CVE-2022-49225 affects the Linux kernel component mt7921s (mt76) where a memory leak could occur in mt7921_load_patch if fw data isn’t released. The fix releases fw data at the end of the routine to prevent leak; the vulnerability manifests locally with an availability impact. Affected context re...

CVE-2022-49244

CVE-2022-49244 concerns the Linux kernel ASoC path for the mediatek mt8192-mt6359 driver. The issue arises from improper reference counting of the device_node returned by of_parse_phandle(): the code increments the refcount, but only calls of_node_put() on the success path, creating a refcount le...

CVE-2022-49338

CVE-2022-49338 affects the Linux kernel in the Mellanox mlx5 core path: CT cleanup happens after TC ct rules cleanup, risking use-after-free of CT shared resources when uplink cleanup ordering is reversed. The resolved description states the fix is to reverse the cleanup/init order so that TC cle...

CVE-2022-49496

The CVE-2022-49496 entry concerns the Linux kernel Mediatek vcodec driver (mtk_vcodec_dec). If the driver runs in subdev mode, dev->pm.dev can be NULL during mtk_vcodec_dec_remove, causing a kernel crash on rmmod mtk-vcodec-dec.ko. All connected documents describe the crash scenario and indica...