CVE-2023-52907

CVE-2023-52907 affects the Linux kernel NFC pn533 driver. A use-after-free occurs in the host controller driver (hcd) when in_urb completes before out_urb, freeing skb data used as the transfer buffer for out_urb. The fix delays sending in_urb until the out_urb callback has run, and splits the co...

CVE-2024-26762

CVE-2024-26762 (Linux kernel) concerns CXL error handling. The fix addresses a crash: after unbinding the memory device (cxl_mem) following a RAS event, a later AER notification could access unmapped registers. The patch adds a check to verify memdev binding before reaping status register values,...

CVE-2024-38306

The CVE-2024-38306 issue resides in the Linux kernel’s BTRFS extent IO path. A race stems from how folio::private is managed during attach of extent folios: after the commit that refactored alloc_extent_buffer() to an allocate-then-attach flow, code guarded by mapping->i_private_lock was moved...

CVE-2024-40926

CVE-2024-40926 affects the Linux kernel DRM Nouveau driver. The issue occurs when runtime PM resumes on headless cards that lack display hardware, where hpd_work and hpd_lock are left uninitialized and scheduling hpd_work triggers a BUG. The patch adds a headless flag to DRM and instructs the sys...

CVE-2024-42113

CVE-2024-42113 affects the Linux kernel: net: txgbe: initialize num_q_vectors for MSI/INTx interrupts. When MSI/INTx are used, wx->num_q_vectors remains uninitialized, causing a kernel panic in wx_alloc_q_vectors() when allocating queue vectors. The description confirms the issue is resolved i...

CVE-2024-44936

CVE-2024-44936 pertains to the Linux kernel driver for rt5033 power supply. The issue arose after reworking the driver to use devm_power_supply_register(), which dropped i2c_set_clientdata (and the remove callback), while other parts of the driver still relied on i2c clientdata, leading to kernel...

CVE-2024-56682

Summary (CVE-2024-56682) : In the Linux kernel RISCV IRQ domain handling, probing the APLIC driver before IMSIC can leave the parent MSI domain missing, causing a NULL pointer dereference in msi_create_device_irq_domain(). The fix defers the APLIC probe until the parent MSI domain is available an...

CVE-2025-21834

Summary (mode C): CVE-2025-21834 relates to the Linux kernel where a seccomp passthrough for uretprobe systemcalls was not filtered. When uretprobes are attached to processes in Docker, the retprobe can cause the traced process to segfault because the default seccomp filters block this kernel-int...

CVE-2025-21860

The CVE-2025-21860 entry relates to a Linux kernel zswap bug in which inconsistent accounting occurs when zswap_store_page() fails to swap an entire folio after some base pages were swapped. The root cause was skipping charging zswap entries on failed swaps, which could lead to uncharged entries ...

CVE-2025-37896

CVE-2025-37896 addresses a divide-by-zero in spi-mem duration calculation (spi_mem_calc_op_duration) when dummy bytes are zero in certain SPI flash operations (e.g., Winbond SPINAND write_cache/update_cache). The fix skips the ncylcles calculation when dummy bytes are zero, preventing the divide ...

CVE-2025-38045

CVE-2025-38045 is a Linux kernel vulnerability affecting the wifi driver (iwlwifi). The issue arises from an incorrect order of debug actions; the fix adds a dump split and executes the FW reset in the middle of the dump rather than causing the FW to kill itself on error. This change means that s...

CVE-2025-38138

CVE-2025-38138 concerns the Linux kernel TI DMA engine, specifically the ti udmaProbe path. The root cause is a NULL pointer dereference when devm_kasprintf() returns NULL due to memory allocation failure, because udma_probe() did not check this return value. The vulnerability is mitigated by a p...

CVE-2025-38277

CVE-2025-38277 affects the Linux kernel mtd: nand: ecc-mxic code. The bug occurs when ctx->steps is zero: the loop over ECC steps is skipped and ret is left uninitialized, later checked/returned, causing undefined behavior and potential user-space disruption or kernel crashes. The fix initiali...

CVE-2025-38303

The CVE-2025-38303 issue affects the Linux kernel Bluetooth path: eir_create_adv_data may add EIR_FLAGS and EIR_TX_POWER without validating that they fit, potentially causing a crash. The description states this vulnerability has been resolved in the kernel (fix for crashes in eir_create_adv_data...

CVE-2025-38310

CVE-2025-38310 refers to a Linux kernel vulnerability in seg6 where validation of nexthop addresses could read uninitialized memory if the provided length exceeded the actual data; the fix enforces that the provided length exactly matches the specified length. The connected advisories confirm the...

CVE-2025-38414

The CVE-2025-38414 entry concerns the Linux kernel wifi driver ath12k for PCIe devices, where GCC_GCC_PCIE_HOT_RST was misdefined for the WCN7850. The issue caused kernel crashes on certain platforms due to divergent register definitions between WCN7850 and QCN9274; the fix moves GCC_GCC_PCIE_HOT...

CVE-2025-38490

CVE-2025-38490 – Linux kernel : The vulnerability concerns the page_pool_put_full_page() call in net: libwx, where pages could be double-freed, potentially causing a kernel panic. The fix removes the duplicate page_put path so pages are reused unless freeing Rx buffers or building a skb when the ...

CVE-2026-46124

CVE-2026-46124 affects the Linux kernel isofs filesystem. The vulnerability arises because isofs_fh_to_dentry/isofs_fh_to_parent pass an attacker-controlled block number from an NFS file handle to isofs_export_iget(), which only rejects block == 0 before calling isofs_iget and sb_bread. A crafted...

CVE-2000-0289

Summary: CVE-2000-0289 concerns the Linux kernel IP Masquerade (NAT) feature on 2.2.x, where the UDP DLOOSE behavior can allow an attacker to send arbitrary UDP packets to hosts behind a vulnerable NAT by matching only destination IP/port, potentially affecting existing sessions. What is affected...

CVE-2003-0018

CVE-2003-0018 concerns Linux kernel 2.4.10–2.4.21-pre4 where O_DIRECT is mishandled, allowing local attackers with write privileges to read portions of previously deleted files or cause filesystem corruption. Related advisories (SUSE CVE-2003-0956; Debian DSA-358/423) note multiple O_DIRECT-relat...

CVE-2006-2934

CVE-2006-2934 is a kernel-level DoS in SCTP conntrack (netfilter) for Linux kernels 2.6.17 before 2.6.17.3 and 2.6.16 before 2.6.16.23, where a crafted packet without chunks can trigger a value bug leading to a NULL dereference and crash. The connected advisories reference upstream kernel patches...

CVE-2006-6053

CVE-2006-6053 affects the Linux kernel 2.6.x: the ext3fs_dirhash function can crash the kernel via a malformed ext3 stream, enabling a local user to cause a denial of service. The issue is tied to the ext3 filesystem code in the 2.6.x series and is listed among kernel vulnerabilities addressed by...

CVE-2007-0006

The CVE-2007-0006 issue affects Linux kernels 2.6.9 through 2.6.20 in the key_alloc_serial code, where a fault in the key serial number collision avoidance can be triggered by a local user, leading to a crash via a NULL pointer dereference (local DoS). The vulnerability is documented across multi...

CVE-2007-1000

The CVE-2007-1000 issue affects the Linux kernel up to version 2.6.20.2, where the ipv6_getsockopt_sticky function in net/ipv6/ipv6_sockglue.c can trigger a NULL dereference through certain getsockopt calls, allowing local users to read arbitrary kernel memory. The vulnerability stems from a NULL...

CVE-2007-1730

CVE-2007-1730 is a local kernel vulnerability due to an integer signedness error in the DCCP path (do_dccp_getsockopt) affecting Linux kernels 2.6.20 and later. The flaw allows a local user to read kernel memory or trigger a denial of service via a negative optlen. This is confirmed by Red Hat CV...

CVE-2008-5701

CVE-2008-5701 is a Linux kernel local denial-of-service vulnerability on 64-bit MIPS platforms caused by an array index error in arch/mips/kernel/scall64-o32.S. It affects kernel versions prior to 2.6.28-rc8, where an o32 syscall with a small number can trigger an out-of-bounds access to the sysc...

CVE-2009-1914

CVE-2009-1914 affects the Linux kernel on sparc64. The function pci_register_iommu_region in arch/sparc/kernel/pci_common.c in versions prior to 2.6.29 can be abused by a local user to crash the system (denial of service) by reading /proc/iomem, due to uninitialized pointers in the context of the...

CVE-2011-4611

The CVE-2011-4611 entry relates to the Linux kernel on POWERPC where an integer overflow in perf_event_interrupt (arch/powerpc/kernel/perf_event.c) before version 2.6.39 can allow a local user to trigger a denial of service via performance-event handling. Affected: Linux kernel releases prior to ...

CVE-2012-6541

The CVE-2012-6541 flaw affects the Linux kernel prior to version 3.6. The vulnerability resides in ccid3_hc_tx_getsockopt within net/dccp/ccids/ccid3.c, where an internal structure is not initialized, enabling local attackers to read sensitive information from kernel stack memory via a crafted ap...

CVE-2013-1826

The CVE-2013-1826 issue affects the Linux kernel’s xfrm_state_netlink() in net/xfrm/xfrm_user.c prior to 3.5.7. The vulnerability stems from not properly handling error conditions in dump_one_state() calls, which can allow a local user with CAP_NET_ADMIN to gain privileges or trigger a denial of ...

CVE-2013-2548

The CVE-2013-2548 entry concerns the Linux kernel crypto user configuration API (the report API). Specifically, in crypto_report_one (crypto/crypto_user.c), an incorrect length value during a copy operation in the report path allows a local user with CAP_NET_ADMIN to leak kernel memory. The descr...

CVE-2013-3076

CVE-2013-3076 affects the Linux kernel prior to or up to 3.9-rc8, where the crypto API does not initialize certain length variables. This allows local attackers to read kernel stack memory via crafted recvmsg/recvfrom calls, related to hash_recvmsg (crypto/algif_hash.c) and skcipher_recvmsg (cryp...

CVE-2013-3227

CVE-2013-3227 affects the Linux kernel. The vulnerability is in the caif_seqpkt_recvmsg function (net/caif/caif_socket.c) where a length variable is not initialized. This can allow a local user to obtain sensitive information from kernel stack memory through a crafted recvmsg or recvfrom system c...

CVE-2013-4300

CVE-2013-4300 affects the Linux kernel (pre-3.11). The vulnerability arises from a faulty capability check in scm_check_creds() in net/core/scm.c that uses an incorrect namespace, enabling local users to gain privileges via PID spoofing. Impact: local privilege escalation with complete confidenti...

CVE-2014-7284

CVE-2014-7284 affects the Linux kernel’s net_get_random_once in net/core/utils.c for 3.13.x and 3.14.x before 3.14.5 on certain Intel CPUs. The issue is that the slow-path to seed randomness is not executed, increasing predictability of TCP sequence numbers, TCP/UDP port numbers, and IP ID values...

CVE-2015-2686

The CVE-2015-2686 issue affects the Linux kernel 3.19.x, specifically before 3.19.3. It arises from not validating certain range data for sendto/recvfrom in net/socket.c, enabling a local privilege escalation via a subsystem using the copy_from_iter function in the iov_iter interface, with the Bl...

CVE-2017-0523

CVE-2017-0523 is an elevation-of-privilege vulnerability in the Qualcomm Wi‑Fi driver that could allow a local malicious app to execute arbitrary code in the kernel. The CVSS3 vector indicates LOCAL access, high complexity, no privileges required, but user interaction is required; root cause is e...

CVE-2017-5550

CVE-2017-5550 describes an off-by-one/error in the Linux kernel pipe_advance function (lib/iov_iter.c) that could allow local attackers to read from uninitialized kernel heap memory via a pipe, before the fixed 4.9.5 release. Connected advisories (EulerOS, Unity Linux) reference kernel versions b...

CVE-2017-8106

The CVE-2017-8106 issue affects the Linux kernel (arch/x86/kvm/vmx.c) in versions 3.12–3.15. The vulnerability arises from the handle_invept path, enabling privileged KVM guest OS users to trigger a NULL pointer dereference via a single-context INVEPT with a NULL EPT pointer, causing a denial of ...

CVE-2021-47224

CVE-2021-47224 concerns the Linux kernel ll_temac driver. A use-after-free can occur on the DMA side if the skb is freed while fragments are still in use because the skb pointer was piggy-backed on the first TX buffer descriptor (BD). The resolved description states the fix was to ensure the skb ...

CVE-2021-47234

CVE-2021-47234 (Linux kernel) : The issue concerns the phy-mtk-tphy driver, specifically in the mtk_phy_init() error path, where resources could leak. The fix adds a call to clk_disable_unprepare() in the error handling to release resources and prevent leaks. The vulnerability description and con...

CVE-2021-47531

Mode C CVE-2021-47531: Linux kernel MSM DRM mmap handling fixed. The issue occurred when switching to the new mmap path (drm/msm: Implement mmap as GEM object function) and skipping the default mmap code. This caused missing VM_FLAGS and page-prot setup, contributing to crashes on ARC++ Chromeboo...

CVE-2021-47569

CVE-2021-47569 : In the Linux kernel io_uring path, cancellation of tasks can fail for EXITING tasks when the callback runs in a fallback path. The issue is triggered during io_uring cancellation logic in fs/io_uring.c (recorded at io_try_cancel_userdata+0x3c5/0x640). The call chain shows timeout...

CVE-2021-47613

CVE-2021-47613 concerns a Linux kernel i2c virtio issue where the notify callback could run before all buffers are completed, risking incorrect I2C data or guest memory corruption. The confirmed fix is to call virtio_get_buf() from the notify handler (as in other virtio drivers) and to wait for a...

CVE-2022-48718

CVE-2022-48718 concerns a NULL pointer dereference in the Linux kernel’s drm mxsfb driver. The vulnerability arises when drm_atomic_get_new_bridge_state can return a NULL pointer, which mxsfb may dereference. A fix was implemented that avoids dereferencing a NULL by assuming a fixed format instea...

CVE-2022-48726

CVE-2022-48726 affects the Linux kernel’s RDMA/ucma code path, specifically a use-after-free in ucma_cleanup_multicast and related flows (ucma_destroy_private_ctx, ucma_write) caused by touching a concurrently freed multicast structure during a multicast leaves operation. The description notes th...

CVE-2022-48729

CVE-2022-48729: In the Linux kernel’s InfiniBand hfi1 driver (ipoib), a panic occurs when ipoib send_queue_size is increased above the default. The root cause is a shift calculation that used the ring size instead of the txq item size, leading to a panic trace in hfi1_ipoib_drain_tx_ring and a ch...

CVE-2022-48745

The CVE-2022-48745 entry refers to a Linux kernel vulnerability in the net/mlx5 component where a race condition can occur due to del_timer() usage during the fw reset polling flow. The affected code substitutes del_timer() with del_timer_sync() to avoid deactivation of a timer while its interrup...

CVE-2022-48780

CVE-2022-48780 (Linux kernel) : The vulnerability in net/smc arises from overwriting clcsock callback function pointers during multiple fallbacks, which can create a loop: clcsk->sk_error_report → smc_fback_error_report → smc_fback_forward_wakeup → clcsock_callback overwritten → smc->clcsk_...

CVE-2022-48813

CVE-2022-48813 concerns the Linux kernel’s DSA Felix support. The advisory notes that using devres for the MDIO bus caused mdiobus_free() to panic when freed via devm_mdiobus_free(), unless the bus was unregistered first. For the Felix VSC9959 switch (PCI device), the recommended remediation is t...