CVE-2026-43383

CVE-2026-43383 affects the Linux kernel’s TCP MD5 signature handling. The root cause is a non-constant-time MAC comparison, enabling potential timing attacks. The vulnerability is addressed by changing the MAC comparison to a constant-time implementation using the appropriate helper function. The...

CVE-2026-46137

CVE-2026-46137 affects the Linux kernel MPTCP implementation. The mptcp_pm_add_timer() helper runs as a timer callback in softirq context and can race with socket state unless the socket lock is held with bh_lock_sock(). The mitigation is to hold the lock and retry if the socket is in use, mirror...

CVE-2026-46230

CVE-2026-46230 affects the Linux kernel’s drm/amdgpu/vcn3 component. The vulnerability is an Out-of-Bounds read during decoder message parsing, due to missing bounds checks; the fix adds checks against the end of the BO before msg access. Impact is described as high severity (CVSSv3.1: Local, Low...

CVE-2026-53059

The CVE-2026-53059 issue is a Linux kernel dm-log out-of-bounds write caused by an unsigned 32-bit region_count in create_log_context() overflowing when dm_sector_div_up() returns a 64-bit value. Large region_space can truncate bitset_size, causing clean_bits, sync_bits, and recovering_bits to be...

CVE-2026-53388

CVE-2026-53388 : Linux kernel fuse module vulnerability where fuse_try_move_folio() unlocks the request on entry but does not re-lock on the success path, allowing a use-after-free of fuse_io_args via fuse_chan_abort() and delayed copying logic. The issue is resolved by calling lock_request() bef...

CVE-2026-64041

The issue CVE-2026-64041 affects the Linux kernel ASoC fs210x codec driver. In fs210x_effect_scene_info(), a string is copied with strscpy using strlen(SRC) + 1 (DST) instead of a bound-limited size, enabling a potential buffer overflow when strlen(SRC) >= sizeof(DST). The fix uses correct bou...

CVE-2026-64279

CVE-2026-64279 concerns the Linux kernel i2c core: a race in adapter deregistration where an adapter may be accessed after resources are freed. The fix removes the adapter from the IDR before tearing it down during deregistration or on registration failure to prevent use-after-free of resources s...

CVE-1999-0183

CVE-1999-0183 affects Linux implementations of TFTP, described as allowing traversal to read files outside the restricted directory. The OpenVAS/Nessus entries confirm a directory-traversal vulnerability enabling arbitrary file reads via TFTP server responses (e.g., tftpd misconfiguration allows ...

CVE-2001-0317

The CVE covers a race condition in Linux kernel ptrace handling that lets an unprivileged local user attach to and modify a running setuid process to gain root. Affected: Linux kernel 2.2.x and 2.4.x (ptrace/procfs/execve paths cited). Root cause: race in ptrace usage during privileged operations...

CVE-2004-1016

CVE-2004-1016 affects the Linux kernel (2.4.x up to 2.4.28 and 2.6.x up to 2.6.9) where the scm_send function in the kernel SCM layer can be triggered by local users. By crafting auxiliary messages passed to sendmsg, this can lead to a deadlock and a system hang (denial of service). Public record...

CVE-2005-3055

CVE-2005-3055 affects the Linux kernel 2.6.8 through 2.6.14-rc2. A local user-space process can issue a USB Request Block (URB) to a USB device and terminate before completion, causing a stale pointer reference and potential kernel OOPS/Denial of Service. Public sources in connected docs confirm ...

CVE-2005-3181

CVE-2005-3181 affects the Linux kernel audit subsystem when CONFIG_AUDITSYSCALL is enabled. The flaw arises from using an incorrect function to free names_cache memory, preventing proper tracking by AUDITSYSCALL and causing a memory leak that can lead to local denial of service via memory exhaust...

CVE-2005-4811

CVE-2005-4811 concerns the Linux 2.6 kernel hugepage code (hugetlb.c). In certain configurations, a local user could trigger an mmap error before a prefault, causing an error in unmap_hugepage_area and potentially crash the system (local DoS). The connected advisories confirm this as a kernel fla...

CVE-2006-0038

The CVE-2006-0038 issue is a local kernel vulnerability in Linux 2.6.x where arithmetic in netfilter’s do_replace() can overflow a buffer. Exploitation requires CAP_NET_ADMIN rights and is tied to virtualization environments (e.g., OpenVZ). The advisory notes that this can lead to arbitrary code ...

CVE-2006-1066

CVE-2006-1066 is tied to the Linux kernel prior to 2.6.16 on x86_64 with preemption enabled. The vulnerability allows a local attacker to trigger a denial of service (oops) by using multiple ptrace tasks performing single steps, which can cause corruption of the DEBUG_STACK stack during the do_de...

CVE-2006-2071

CVE-2006-2071 affects Linux kernels 2.4.x and 2.6.x up to 2.6.16. It arises from a flaw in the mprotect handling that allowed a local user to grant write permission to a read-only attachment of a shared memory segment, bypassing IPC permissions and enabling modification of the attachment. Reporte...

CVE-2007-0772

The CVE-2007-0772 entry applies to the Linux kernel 2.6.13 and earlier, with the issue fixed in 2.6.20.1. A crafted NFSACL 2 ACCESS request could trigger a free of an incorrect pointer, leading to a remote denial of service (oops). Affected versions before 2.6.20.1 are vulnerable; mitigation is t...

CVE-2011-3593

CVE-2011-3593 : The Linux kernel 2.6.32 on Red Hat Enterprise Linux 6 is affected by a vulnerability in the VLAN patch within net/8021q/vlan_core.c (vlan_hwaccel_do_receive). This enables remote attackers to cause a denial of service (system crash) via priority-tagged VLAN frames. Connected advis...

CVE-2013-2898

The CVE-2013-2898 entry concerns the Linux kernel HID subsystem, specifically drivers/hid/hid-sensor-hub.c. When CONFIG_HID_SENSOR_HUB is enabled, the vulnerability affects the kernel up through version 3.11 and allows physically proximate attackers to obtain sensitive information from kernel mem...

CVE-2013-4254

The CVE-2013-4254 issue affects the Linux kernel on ARM where the validate_event function in arch/arm/kernel/perf_event.c before 3.10.8 can be triggered by adding a hardware event to an event group led by a software event, allowing local privilege escalation or causing a NULL pointer dereference ...

CVE-2014-5045

CVE-2014-5045 – Linux kernel mountpoint_last bug (pre-3.15.8) Affected: Linux kernel versions prior to 3.15.8.Root cause: The mountpoint_last function in fs/namei.c does not properly maintain a reference count when unmount is used in conjunction with a symlink.Impact: Local users could cause deni...

CVE-2015-1339

CVE-2015-1339 affects the Linux kernel: memory leak in cuse_channel_release (fs/fuse/cuse.c) can be triggered by opening /dev/cuse many times, leading to local denial of service via memory consumption (unbounded memory use). The vulnerability is reported as present in kernel versions before 4.4. ...

CVE-2015-2672

The CVE-2015-2672 entry concerns the Linux kernel’s xsave/xrstor implementation (arch/x86/include/asm/xsave.h). Vulnerable code paths exist in kernels before 3.19.2 where certain .altinstr_replacement pointers are created, failing to provide protection against instruction faulting. Local attacker...

CVE-2016-5343

CVE-2016-5343 affects the Linux kernel driver drivers/soc/qcom/qdsp6v2/voice_svc.c (QDSP6v2 Voice Service) used in Qualcomm MSM Android contributions. The vulnerability is a buffer overflow in voice_svc_send_req triggered by a write request, which can cause memory corruption and enable a denial o...

CVE-2017-1000377

CVE-2017-1000377 concerns a vulnerability in PAX Linux where the default stack guard page is too small and can be bypassed, allowing a bypass of stack protections. The core details indicate this affects PAX Linux kernel versions as of 19 June 2017, originally from GRSecurity and shipped by other ...

CVE-2021-47093

CVE-2021-47093: SUSE advisories SIG- Linux kernel (SUSE SLES/openSUSE) notes a memleak in intel_pmc_core during module init when platform device registration fails. The fix frees the platform device with platform_device_put() to release resources (e.g., device name). Connected documents confirm t...

CVE-2021-47096

In the Linux kernel, the following vulnerability has been resolved: ALSA: rawmidi - fix the uninitalized user_pversion The user_pversion was uninitialized for the user space file structurein the open function, because the file private structure usekmalloc for the allocation. The kernel ALSA seque...

CVE-2021-47242

CVE-2021-47242 affects the Linux kernel and is tied to a fix for an issue in MPTCP subflow error reporting. The root cause was a soft lookup caused when subflow_error_report() attempted to acquire mptcp_data_lock across call paths that could already hold other locks, triggering a soft lockup unde...

CVE-2021-47313

A memory leak vulnerability exists in the Linux kernel within the cpufreq: CPPC component, specifically in the cppc_cpufreq_cpu_init function. The issue is caused by a failure to free allocated resources during policy ->init() failures, which constitutes a case of uncontrolled resource consump...

CVE-2021-47332

CVE-2021-47332 affects the Linux kernel’s ALSA usx2y component. The issue arises from calling free_pages_exact() with a NULL address, which could lead to a kernel Oops if not guarded. The description confirms a NULL check was added to prevent this invalid free path, addressing the vulnerability. ...

CVE-2021-47604

CVE-2021-47604 concerns a Linux kernel vulnerability in vduse where get_config() failed to bound-check the offset, causing a potential out-of-bounds read when offset > dev->config_size due to unsigned subtraction. The issue is resolved in the Linux kernel (as per the description), with advi...

CVE-2022-48644

Summary (CVE-2022-48644): A Linux kernel net/sched taprio offload bug could crash the kernel when disabling offload if flags were left at TAPRIO_FLAGS_INVALID after an error path. The code evaluated FULL_OFFLOAD_IS_ENABLED(q->flags) on an invalid flag value (U32_MAX), causing a crash when tapr...

CVE-2022-48714

Summary of CVE-2022-48714 : The Linux kernel vulnerability arises in the ringbuffer mapping used by BPF. The root cause is a Kasan-related mislabeling where mappings created from allocated pages were treated as VM_ALLOC, triggering out-of-bounds reports after vmap() when KASAN is enabled. The fix...

CVE-2022-48784

CVE-2022-48784 : In the Linux kernel’s cfg80211 code, a race can occur during netlink owner interface destruction. The previous fix for a deadlock left a race when cfg80211_destroy_ifaces() runs while nl80211_netlink_notify() marks interfaces as nl_owner_dead. The issue arises from two loops: fir...

CVE-2022-48807

CVE-2022-48807 concerns the Linux kernel ice driver and the LAG NETDEV_UNREGISTER notifier path. The issue arises because the same notifier handler was invoked for both NETDEV_BONDING_INFO LAG unlink and NETDEV_UNREGISTER events, passing a netdev_notifier_info structure that differs between event...

CVE-2022-48862

The CVE-2022-48862 vulnerability is in the Linux kernel vhost/vhost.c and related vhost/vsock.c handling of IOTLB entries. The root cause is a range-size overflow in vhost_iotlb_add_range_ctx(): when start = 0 and last = ULONG_MAX, an entry with size = 0 is created, and subsequent packet processi...

CVE-2022-48930

CVE-2022-48930 corresponds to a deadlock in the Linux kernel RDMA/ib_srp path. The fix removes the flush_workqueue(system_long_wq) call, which was deadlock‑prone and redundant with a preceding cancel_work_sync(). The associated Nessus entries reproduce the advisory text and reference kernel-stabl...

CVE-2022-48937

CVE-2022-48937 affects the Linux kernel io_uring subsystem, specifically a missing schedule point introduced in io_add_buffers. The vulnerability can cause soft lockups when a loop runs ~65,535 times performing kmalloc allocations, with DEBUG features (e.g., KASAN) enabled amplifying the issue. R...

CVE-2022-48945

The CVE-2022-48945 issue is in the Linux kernel’s media/vivid path where the compose height boundary is not checked in V4L2_SEL_TGT_CROP after adjustment. The root cause is an unsafe boundary calculation that can trigger a page fault (not-present page) via a local access (memcpy_erms) during vivi...

CVE-2022-49184

The CVE-2022-49184 issue affects the Linux kernel under net: sparx5: switchdev, where a NULL pointer dereference could occur if devm_kzalloc() returns NULL and the code dereferences the pointer. The description across connected sources indicates the vulnerability was resolved in the Linux kernel ...

CVE-2022-49278

CVE-2022-49278: Linux kernel remoteproc vulnerability in rproc_coredump_write() where a count underflow was possible. The fix adds a count check for zero, mirroring the validation in rproc_recovery_write(), to prevent underflow. This is resolved in the kernel codebase; patch references are in the...

CVE-2022-49510

CVE-2022-49510 concerns a Linux kernel issue in the DRM/OMAP driver where a NULL pointer (r_ovl) dereference occurs when accessing ovl->idx, triggering a NULL-deref in omap_overlay.c. The vulnerability stems from a coccicheck warning that was fixed by correcting r_ovl->idx to ovl->idx. T...

CVE-2022-49665

CVE-2022-49665 affects the Linux kernel (platform/x86: thinkpad_acpi) and is caused by a memory leak in EFCH MMIO resource handling: release_resource() does not free the resource as release_mem_region() would, so the resource must be freed explicitly to avoid leaks. The issue is addressed by a ke...

CVE-2022-49681

The CVE-2022-49681 issue in the Linux kernel concerns xtensa: xtfpga setup where of_find_compatible_node() may return a node with an incremented refcount. The fix is to call of_node_put() when the node is no longer in use to prevent a refcount leak. Public advisories (Tencent/Unity Linux integrat...

CVE-2022-49817

Summary of CVE-2022-49817 (Linux kernel) : The MHI network driver (mhi_net_dellink) leaked memory because it registered a net device without setting needs_free_netdev and did not call free_netdev on unregister. The concrete remediation is a patch that adds free_netdev() usage since netdev_priv is...

CVE-2022-49828

CVE-2022-49828 affects the Linux kernel hugetlbfs: when a HugeTLB page is poisoned, the page was previously truncated from the page cache; the patch keeps the poisoned page in the cache. As described, subsequent reads/mappings can trigger the allocation of a new hugepage instead of signaling pois...

CVE-2022-49968

CVE-2022-49968 concerns the Linux kernel driver ieee802154/adf7242. The race is a use-after-free between adf7242_remove (which cancels delayed work and may destroy the workqueue) and adf7242_channel (which could run during or after destruction). The root cause is that the upper layer may detach w...

CVE-2022-50074

CVE-2022-50074 is a Linux kernel vulnerability related to apparmor memleak in aa_simple_write_to_buffer. The issue arises when copy_from_user fails: memory is freed by kvfree, but the management struct and data blob are allocated independently, so freeing only the data via kvfree leaks the memory...

CVE-2022-50160

CVE-2022-50160 affects the Linux kernel mtd maps code. The root cause is a refcount leak from of_find_matching_node(): the returned node pointer’s refcount isn’t decremented when no longer needed. The fixed code adds a of_node_put() to avoid the leak, and related patches are documented in kernel ...

CVE-2022-50166

CVE-2022-50166 affects the Linux kernel Bluetooth HCI subsystem. When the HCI work queue is drained, a delayed command could still be queued to the drained workqueue, triggering a timeout in hci_cmd_timeout and a kernel warning. The root cause is the draining of the command/event/data processing ...