CVE-2005-3275

CVE-2005-3275 describes a race in the Linux kernel NAT code (ip_nat_proto_tcp.c and ip_nat_proto_udp.c) where a variable is incorrectly declared static. This enables a remote attacker to cause memory corruption by NATing two packets for the same protocol simultaneously, leading to a denial of ser...

CVE-2005-3276

CVE-2005-3276 affects the Linux 2.6 kernel: the sys_get_thread_area path in process.c may copy an uninitialized data structure to userspace, exposing kernel memory to a local user. Affected versions are 2.6 before 2.6.12.4 and 2.6.13. The impact is information disclosure of kernel data to untrust...

CVE-2006-1066

CVE-2006-1066 is tied to the Linux kernel prior to 2.6.16 on x86_64 with preemption enabled. The vulnerability allows a local attacker to trigger a denial of service (oops) by using multiple ptrace tasks performing single steps, which can cause corruption of the DEBUG_STACK stack during the do_de...

CVE-2006-1857

The CVE-2006-1857 entry describes a buffer overflow in the SCTP implementation of the Linux kernel up to version 2.6.16.17. A remote attacker could trigger this via a malformed HB-ACK chunk, potentially causing a crash (DoS) and possibly executing arbitrary code. A fix is available in kernel 2.6....

CVE-2006-5158

CVE-2006-5158 affects the Linux kernel’s NFS lockd (nlmclnt_mark_reclaim in clntlock.c). The connected advisories (RHSA-2007-0488, CESAs for RHEL/CentOS, SL) describe a vulnerability in NFS locking daemon that can cause a denial of service (deadlock) or kernel oops via NULL dereference, allowing ...

CVE-2007-3851

CVE-2007-3851 affects the Linux kernel’s i915 DRM path on Intel 965-era chipsets. The flaw lets a local user with access to an X11 session and DRM write to arbitrary memory via a crafted batchbuffer, enabling privilege escalation. The issue is tied to the DRM/i915 driver before kernel 2.6.22.2. P...

CVE-2008-2137

The CVE-2008-2137 entry describes a Linux kernel vulnerability in the SPARC/SPARC64 mmap checks. Affected are Linux kernel 2.4 before 2.4.36.5 and 2.6 before 2.6.25.3, where sparc_mmap_check (arch/sparc/kernel/sys_sparc.c) and sparc64_mmap_check (arch/sparc64/kernel/sys_sparc.c) omit some virtual...

CVE-2009-0935

CVE-2009-0935 affects Linux kernel inotify_read across 2.6.27–2.6.27.13, 2.6.28–2.6.28.2, and 2.6.29-rc3. The issue allows local users to trigger a denial of service (OOPS) by reading with an invalid address to an inotify instance, causing the event list mutex to be unlocked twice and preventing ...

CVE-2009-1184

CVE-2009-1184 affects the Linux kernel’s SELinux subsystem: the function security/selinux/hooks.c (selinux_ip_postroute_iptables_compat) omits avc_has_perm checks for the node and port when compat_net is enabled, allowing local users to bypass certain network-traffic restrictions. Impact is parti...

CVE-2011-1023

CVE-2011-1023 affects the Linux kernel RDS (Reliable Datagram Sockets) subsystem prior to 2.6.38. The issue arises in congestion map updates, allowing a local, unprivileged user to trigger a denial of service (BUG_ON and system crash) via loopback (loop) or InfiniBand (ib) transmit vectors. The v...

CVE-2011-2928

CVE-2011-2928 affects the Linux kernel prior to 3.1-rc3, specifically the befs_follow_link function in fs/befs/linuxvfs.c. The flaw does not validate the length attribute of long symlinks on a malformed Be filesystem, enabling a local attacker to trigger an incorrect pointer dereference and OOPS,...

CVE-2011-4080

CVE-2011-4080 affects the Linux kernel: sysrq_sysctl_handler in kernel/sysctl.c did not require CAP_SYS_ADMIN to modify dmesg_restrict, enabling local users (e.g., in LXC) to bypass restrictions and read the kernel ring buffer with root privileges. Public sources (Red Hat, SUSE, NVD) cite impact ...

CVE-2011-4324

The CVE-2011-4324 entry affects the Linux kernel, specifically the NFSv4 implementation. A bug in encode_share_access() within fs/nfs/nfs4xdr.c allows local attackers to cause a denial of service and system crash by using mknod on an NFSv4 filesystem. The vulnerability exists in versions of the k...

CVE-2013-1772

CVE-2013-1772 affects the Linux kernel 3.x prior to 3.4.33. The vulnerability stems from the log_prefix function in kernel/printk.c, which fails to correctly remove a prefix from the syslog header, enabling a local attacker with /dev/kmsg write access to trigger call_console_drivers and cause a d...

CVE-2013-5634

CVE-2013-5634 affects the Linux kernel on ARM when KVM is used: arch/arm/kvm/arm.c allows a host OS user to trigger a denial of service (NULL pointer dereference, OOPS, host crash) by omitting vCPU initialization before a KVM_GET_REG_LIST ioctl. The issue is fixed by upgrading to a kernel version...

CVE-2014-8481

CVE-2014-8481 affects the Linux kernel KVM arch/x86/kvm/emulate.c; the instruction decoder mishandles invalid instructions, allowing guest OS users to trigger a NULL pointer dereference and host crash via a crafted application that either fetches an invalid instruction or uses too many bytes. Roo...

CVE-2015-8950

CVE-2015-8950 affects the Linux kernel (arch/arm64/mm/dma-mapping.c) prior to 4.0.3, where uninitialized data structures in the ION memory-management path can be exposed via dma_mmap. This local-access vulnerability could allow a non-privileged user to read kernel memory. The public references in...

CVE-2017-1000377

CVE-2017-1000377 concerns a vulnerability in PAX Linux where the default stack guard page is too small and can be bypassed, allowing a bypass of stack protections. The core details indicate this affects PAX Linux kernel versions as of 19 June 2017, originally from GRSecurity and shipped by other ...

CVE-2018-11232

The vulnerability CVE-2018-11232 affects the Linux kernel, specifically the etm_setup_aux function in drivers/hwtracing/coresight/coresight-etm-perf.c, and exists in versions prior to 4.10.2. The root cause is that a parameter is incorrectly used as a local variable, which can lead to a denial of...

CVE-2018-20509

CVE-2018-20509 affects the Linux kernel 4.14.90, specifically the function print_binder_ref_olocked in drivers/android/binder.c. Local users can read lines like “ref *desc *node” in a debugfs file to obtain sensitive address information. Exploitation details are not provided in the connected docu...

CVE-2019-18810

CVE-2019-18810 affects the Linux kernel before 5.3.8, specifically a memory leak in komeda_wb_connector_add() within drivers/gpu/drm/arm/display/komeda/komeda_wb_connector.c. An attacker can trigger memory growth by causing drm_writeback_connector_init() failures, leading to denial of service via...

CVE-2021-47088

CVE-2021-47088 concerns the Linux kernel where the DAMON debugfs interface could trigger a use-after-free by destructing monitoring targets without holding the required lock. The root cause was iterating targets in dbgfs_target_ids_read() while also destroying them in dbgfs_before_terminate() wit...

CVE-2021-47093

CVE-2021-47093: SUSE advisories SIG- Linux kernel (SUSE SLES/openSUSE) notes a memleak in intel_pmc_core during module init when platform device registration fails. The fix frees the platform device with platform_device_put() to release resources (e.g., device name). Connected documents confirm t...

CVE-2021-47204

CVE-2021-47204 affects the Linux kernel’s net: dpaa2-eth driver. The flaw is a use-after-free in dpaa2_eth_remove where access to a freed netdev occurs. The fix moves the debug log to occur before free_netdev(), preventing use-after-free. Public descriptions in connected advisories (AstraLinux, U...

CVE-2021-47239

CVE-2021-47239 : In Linux kernel net/usb, theSmsc75xx driver has a use-after-free in smsc75xx_bind caused by not cleaning up a scheduled work in smsc75xx_reset→smsc75xx_set_multicast. The patch 46a8b29c6306 adds cancel_work_sync and NULLs the dangling pointer (dev->data[0]) to prevent use-afte...

CVE-2021-47240

The CVE-2021-47240 issue affects the Linux kernel’s net: qrtr subsystem, specifically the qrtr_endpoint_post path. Syzbot reported a slab-out-of-bounds Read due to a faulty size handling: if size from qrtr_hdr is 0xfffffffd, ALIGN(size,4) becomes 0, and a read skb_put_data(skb, data + hdrlen, siz...

CVE-2021-47524

CVE-2021-47524 : In the Linux kernel, the serial driver (liteuart) leaked a minor number on probe errors. The fix ensures the allocated minor number is released before returning from probe errors. This entry is tied to kernel versions affected by the liteuart minor-number leak and has been resolv...

CVE-2021-47660

CVE-2021-47660 is addressed by a Linux kernel fix in the ntfs3 filesystem code. The patch resolves memory leaks in an error-handling path of log_replay(), ensuring that on all error paths the allocated resources are released via the existing out path instead of leaking through returns. The descri...

CVE-2022-3103

Technical details about CVE-2022-3103 are not publicly provided in the supplied documents. Monitor for updates from vendors and security advisories; current sources only note an off-by-one issue in the io_uring module without specifics.

CVE-2022-48663

CVE-2022-48663 affects the Linux kernel, specifically the GPIO mockup debugfs handling. The vulnerability arises when unbinding a driver: debugfs entries are removed globally before platform devices are unregistered, which can lead to a NULL pointer dereference on module exit. The disclosed fix u...

CVE-2022-48746

In CVE-2022-48746, the Linux kernel mlx5e bond netevent path incorrectly verified netdev origin: the code only checked for a VF representor and lacked a check that the VF representor was on the same physical device as the bond handling the netevent. The fix adds the missing check and optimizes th...

CVE-2022-48811

CVE-2022-48811 concerns the ibmvnic driver in the Linux kernel. Affected: ibmvnic_open/reset paths in the IBM Power virtualization NIC stack. Root cause: in __ibmvnic_open(), if an error occurs (e.g., when setting link state), release_resources() frees napi structures that are still needed, causi...

CVE-2022-49127

CVE-2022-49127 is a Linux kernel vulnerability fix where the ref_tracker use-after-free detection was added. The patch marks the ref_tracker_dir as dead during ref_tracker_dir_init() and checks this dead status from ref_tracker_alloc() and ref_tracker_free(), aiming to detect buggy dev_put()/dev_...

CVE-2022-49210

The CVE-2022-49210 issue is a Linux-kernel memory-leak in the MIPS pgalloc path. The generic pgd_free() freed only one pgd page, but on 64‑bit systems with PAGE_SIZE_4KB and without MIPS_VA_BITS_48 the PGD_TABLE spans two pages; this mismatch leaks memory. MemFree behavior can reveal the leak. Ro...

CVE-2022-49361

The CVE-2022-49361 entry concerns a Linux kernel issue in f2fs where inline inode sanity checks were strengthened. The bug arose when a fuzzed inode had both inline_data and encrypted flags, and during f2fs_evict_inode() invoked by a rename(), inline data could be converted due to flag conflicts,...

CVE-2022-49510

CVE-2022-49510 concerns a Linux kernel issue in the DRM/OMAP driver where a NULL pointer (r_ovl) dereference occurs when accessing ovl->idx, triggering a NULL-deref in omap_overlay.c. The vulnerability stems from a coccicheck warning that was fixed by correcting r_ovl->idx to ovl->idx. T...

CVE-2022-49665

CVE-2022-49665 affects the Linux kernel (platform/x86: thinkpad_acpi) and is caused by a memory leak in EFCH MMIO resource handling: release_resource() does not free the resource as release_mem_region() would, so the resource must be freed explicitly to avoid leaks. The issue is addressed by a ke...

CVE-2022-49803

CVE-2022-49803 relates to the Linux kernel netdevsim memory leak in nsim_dev->fa_cookie. The issue arises when nsim_dev_trap_fa_cookie_write() allocates fa_cookie with kmalloc and assigns it to nsim_dev->fa_cookie, but nsim_drv_remove() fails to free it, leading to a leak reported by kmemle...

CVE-2022-50016

CVE-2022-50016 concerns the Linux kernel ASoC SOF Intel cnl driver. The issue arises when an IPC reply is processed before the FW_READY message, risking a NULL pointer dereference because reply_data is allocated only after FW_READY. The description notes this condition was observed with IPC4 firm...

CVE-2022-50030

CVE-2022-50030 is a vulnerability in the Linux kernel’s lpfc driver affecting debugfs input handling. According to the provided documents, malformed user input to debugfs can cause buffer overflow crashes due to input strings not fitting internal buffers (space for NULL terminators added). The CV...

CVE-2022-50156

CVE-2022-50156 affects the Linux kernel HID cp2112 driver (cp2112_xfer). The issue is a potential buffer overflow in memcpy when read_length (taken from data->block[0], user-controlled, 0-255) is not bounded, causing overflow of data->block[1] and buf. Patches have added an upper bound to r...

CVE-2022-50159

CVE-2022-50159 concerns the Linux kernel: the function that restores ima-kexec-buffer may read outside the addressable RAM if the previous kernel’s buffer lies beyond the new kernel’s memory map, risking kernel panic when booting with mem=X. A fix was implemented to validate the returned PFN rang...

CVE-2022-50169

CVE-2022-50169 references a vulnerability in the Linux kernel’s wifi/wil6210 debugfs handling (wil_write_file_wmi). The root cause is that simple_write_to_buffer() succeeds if any single byte is initialized, which can leak information because the entire buffer may not be initialized. The fix init...

CVE-2022-50221

CVE-2022-50221 : In the Linux kernel, the drm/fb-helper deferred I/O damage handling could compute an clipping range that allowed an out-of-bounds access when the fbdev screen buffer ended near the start of a page. The patch clamps the maximum memory range to the screen buffer size and also renam...

CVE-2022-50222

CVE-2022-50222 affects the Linux kernel in the VT/TTY subsystem, specifically the Unicode screen buffer initialization. According to the provided description, a kernel infoleak could occur in vcs_read() when the screen buffer is read immediately after a resize. The remediation implemented is to i...

CVE-2023-52907

CVE-2023-52907 affects the Linux kernel NFC pn533 driver. A use-after-free occurs in the host controller driver (hcd) when in_urb completes before out_urb, freeing skb data used as the transfer buffer for out_urb. The fix delays sending in_urb until the out_urb callback has run, and splits the co...

CVE-2023-52910

Summary (CVE-2023-52910) : In the Linux kernel’s iommu/iova, a defect in __alloc_and_insert_iova_range can cause an overflow when retry_pfn is updated. This can allow allocation to succeed incorrectly if retry_pfn overflows (scenario 1: first iova exceeds domain size; scenario 2: domain node with...

CVE-2024-26762

CVE-2024-26762 (Linux kernel) concerns CXL error handling. The fix addresses a crash: after unbinding the memory device (cxl_mem) following a RAS event, a later AER notification could access unmapped registers. The patch adds a check to verify memdev binding before reaping status register values,...

CVE-2024-35792

CVE-2024-35792 refers to a Linux kernel issue in the crypto/rk3288 path where a use-after-free could occur due to an incorrect call order. The description in the connected documents states: the unprepare call must be carried out before the finalize call, as the finalize can free the request. The ...

CVE-2024-38306

The CVE-2024-38306 issue resides in the Linux kernel’s BTRFS extent IO path. A race stems from how folio::private is managed during attach of extent folios: after the commit that refactored alloc_extent_buffer() to an allocate-then-attach flow, code guarded by mapping->i_private_lock was moved...