CVE-2026-100075

A vulnerability exists in the Linux kernel within the RDMA/srpt component. Specifically, the function srpt_alloc_rw_ctxs() fails to properly clean up n_rw_ctx and n_rdma values, leaving behind a dangling rw_ctxs pointer when it fails during a multi-buffer indirect descriptor operation. This overs...

CVE-2026-22999

CVE-2026-22999 is addressed by fixes in the Linux kernel's net/sched code: sch_qfq now avoids freeing an existing class in qfq_change_class() unless a new class and qdisc are allocated, preventing potential use-after-free (UAF). The Ubuntu/Ubuntu USN and SUSE SUSE-SU-2026:1305-1 advisories list t...

CVE-2026-23064

CVE-2026-23064 affects the Linux kernel’s net/sched implementation, specifically the act_ife action. The vulnerability is a NULL pointer dereference in tcf_ife_encode()/ife_encode() that could trigger a general protection fault/oops when a NULL is encountered. The provided trace shows the fault p...

CVE-2026-23416

The CVE-2026-23416 issue affects the Linux kernel (mm/mseal) where vm_area_struct end handling could become stale during VMA merges. The root cause is curr_end not staying in sync when a VMA is updated via vma_modify_flags(), leading to an incorrect curr_start on the next iteration. The fix uncon...

CVE-2026-31716

The CVE-2026-31716 entry covers a Linux kernel NTFS3 flaw in journal replay. Description from multiple sources states that check_file_record() validates rec->total against the record size but not rec->used. The journal-replay handlers read rec->used from disk and use it to compute memmov...

CVE-2026-53059

The CVE-2026-53059 issue is a Linux kernel dm-log out-of-bounds write caused by an unsigned 32-bit region_count in create_log_context() overflowing when dm_sector_div_up() returns a 64-bit value. Large region_space can truncate bitset_size, causing clean_bits, sync_bits, and recovering_bits to be...

CVE-2026-64067

The CVE-2026-64067 issue concerns the Linux kernel netfs component, where stream->subrequests was accessed without proper memory barriers. The vulnerability arises from lockless access to the list of subrequests, allowing race conditions when netfs_collect_read_results() and netfs_collect_writ...

CVE-2026-64279

CVE-2026-64279 concerns the Linux kernel i2c core: a race in adapter deregistration where an adapter may be accessed after resources are freed. The fix removes the adapter from the IDR before tearing it down during deregistration or on registration failure to prevent use-after-free of resources s...

CVE-2026-64355

CVE-2026-64355 (Linux kernel) shows a fix for a vulnerability in BPF devmap handling of fragmented frames. In native XDP, cloning fragmented frames could carry skb_shared_info in tailroom outside the linear area, leaving XDP_FLAGS_HAS_FRAGS set but with invalid frag metadata. The subsequent free ...

CVE-1999-0183

CVE-1999-0183 affects Linux implementations of TFTP, described as allowing traversal to read files outside the restricted directory. The OpenVAS/Nessus entries confirm a directory-traversal vulnerability enabling arbitrary file reads via TFTP server responses (e.g., tftpd misconfiguration allows ...

CVE-2002-0429

CVE-2002-0429 affects Linux kernels 2.4.18 and earlier on x86, via the iBCS compatibility interface (the lcall path in arch/i386/kernel/traps.c). The vulnerability enables a local unprivileged user to kill arbitrary processes. Connected advisories confirm affected architectures and that patches e...

CVE-2004-0109

CVE-2004-0109 describes a buffer overflow in the Linux kernel ISO9660 filesystem for 2.4/2.5/2.6, allowing local users with physical access to overflow kernel memory and execute arbitrary code via a malformed CD containing a long symbolic link entry. The connected documents do not provide additio...

CVE-2004-0986

The CVE-2004-0986 issue affects iptables before 1.2.11, where under certain conditions the required modules fail to load at system startup, causing firewall rules to not be loaded and leaving the system potentially exposed to remote attackers. Connected advisories (SUSE, Debian DSA-580-1, Ubuntu ...

CVE-2005-0178

CVE-2005-0178 describes a race condition in the setsid() handling of the Linux kernel before 2.6.8.1. Local users could crash the kernel and potentially access portions of kernel memory related to TTY changes, locking, and semaphores. Affected software: Linux kernel versions prior to 2.6.8.1 (per...

CVE-2005-3055

CVE-2005-3055 affects the Linux kernel 2.6.8 through 2.6.14-rc2. A local user-space process can issue a USB Request Block (URB) to a USB device and terminate before completion, causing a stale pointer reference and potential kernel OOPS/Denial of Service. Public sources in connected docs confirm ...

CVE-2005-4605

CVE-2005-4605 concerns the Linux kernel procfs implementation. A signedness error in the proc_misc.c code (pre-2.6.15) allows a local attacker to read sensitive kernel memory by manipulating a signed value added to an unsigned value, disclosed via /proc interactions. Public reports document the a...

CVE-2006-1066

CVE-2006-1066 is tied to the Linux kernel prior to 2.6.16 on x86_64 with preemption enabled. The vulnerability allows a local attacker to trigger a denial of service (oops) by using multiple ptrace tasks performing single steps, which can cause corruption of the DEBUG_STACK stack during the do_de...

CVE-2006-6106

The CVE-2006-6106 entry describes several buffer overflows in the Bluetooth driver (net/bluetooth/cmtp/capi.c) of the Linux kernel, specifically in the cmtp_recv_interopmsg function. Affected products/versions include Linux kernel 2.4.22 up to 2.4.33.4 and 2.6.2 up to 2.6.18.5, with 2.6.19.x also...

CVE-2008-2729

CVE-2008-2729 affects the Linux kernel before 2.6.19 on some AMD64 systems. The issue is in arch/x86_64/lib/copy_user.S where, after a kernel memory copy exception, destination memory locations aren’t erased, potentially letting a local user read residual data. Impact: local information disclosur...

CVE-2008-4618

The CVE-2008-4618 issue affects the Linux kernel SCTP implementation prior to 2.6.27, where a protocol violation with an invalid parameter length could trigger a panic and denial-of-service via SCTP processing paths (sctp_sf_violation_paramlen, sctp_sf_abort_violation, sctp_make_abort_violation; ...

CVE-2008-5702

CVE-2008-5702 concerns a buffer underflow in the Linux kernel watchdog driver IB700 SBC (ib700wdt.c) via the ibwdt_ioctl path. Affected software is the Linux kernel prior to 2.6.28-rc1; exploitation could occur through a WDIOC_SETTIMEOUT ioctl on /dev/watchdog by a local user. The Initial Descrip...

CVE-2009-1360

CVE-2009-1360 affects the Linux kernel prior to 2.6.29 when Network Namespace Support (NET_NS) is enabled. The vulnerability lies in __inet6_check_established in net/ipv6/inet6_hashtables.c, where crafted IPv6 traffic can trigger a NULL pointer dereference, enabling remote denial of service (syst...

CVE-2009-4271

CVE-2009-4271 affects Linux kernel 2.6.9–2.6.17 on x86_64/amd64. A local unprivileged user can trigger a NULL pointer dereference when a crafted 32-bit process calls mprotect on the Virtual Dynamic Shared Object (VDSO) page, potentially causing a kernel panic (DoS). The issue is tied to memory pr...

CVE-2011-1474

CVE-2011-1474 affects pax-linux versions 2.6.32.33-test79.patch, 2.6.38-test3.patch, and 2.6.37.4-test14.patch. The root cause is a bad bounds check in arch_get_unmapped_area_topdown triggered by mmap after a MAP_GROWSDOWN mmap, which can loop indefinitely and not release the VM semaphore, potent...

CVE-2011-2700

CVE-2011-2700 affects the Linux kernel prior to 2.6.39.4 on the N900 platform, where multiple buffer overflows in si4713_write_econtrol_string (drivers/media/radio/si4713-i2c.c) can be triggered by a crafted s_ext_ctrls operation using V4L2_CID_RDS_TX_PS_NAME or V4L2_CID_RDS_TX_RADIO_TEXT. The is...

CVE-2011-2942

CVE-2011-2942 is tied to a Red Hat patch affecting the Linux kernel 2.6.18-... on RHEL 5. The issue is in the bridge forward path, specifically br_forward.c __br_deliver, enabling a remote attacker on a bridged network to trigger a NULL pointer dereference and system crash (DoS) or potentially ot...

CVE-2012-3520

CVE-2012-3520 concerns the Netlink implementation in the Linux kernel prior to 3.2.30, where Netlink messages missing SCM_CREDENTIALS data could be spoofed by a local attacker via crafted messages (notably affecting services such as Avahi or NetworkManager). The vulnerability enables a local user...

CVE-2013-4513

Buffer overflow in the oz_cdev_write function of drivers/staging/ozwpan/ozcdev.c in the Linux kernel before 3.12 allows local users to cause a denial of service or possibly other impact via a crafted write. A fix is provided by Linux kernel 3.12+ (patches referenced in the linked advisory), so up...

CVE-2013-4514

CVE-2013-4514 affects the Linux kernel up to version 3.11, specifically in drivers/staging/wlags49_h2/wl_priv.c. The vulnerability is caused by multiple buffer overflows in wl_priv.c related to handling a long station-name string, with exploitation requiring CAP_NET_ADMIN. The affected functions ...

CVE-2015-2672

The CVE-2015-2672 entry concerns the Linux kernel’s xsave/xrstor implementation (arch/x86/include/asm/xsave.h). Vulnerable code paths exist in kernels before 3.19.2 where certain .altinstr_replacement pointers are created, failing to provide protection against instruction faulting. Local attacker...

CVE-2016-9777

KVM in the Linux kernel (before 4.8.12) is vulnerable when I/O APIC is enabled. A guest user can craft an interrupt request to bypass VCPU index restrictions, potentially gaining host privileges or causing a host denial of service via out-of-bounds access and host crash. Affected components: arch...

CVE-2017-0620

CVE-2017-0620 is a local elevation-of-privilege in the Qualcomm Secure Channel Manager driver on Android, allowing a malicious local app to run code in the kernel. Affected: Android devices with Kernel-3.10/3.18 (per the CVE entry). Impact per sources is High (CVSSv3: 7.0). Affected devices liste...

CVE-2021-47193

CVE-2021-47193 affects the Linux kernel SCSI PM80XX driver (pm80xx) where memory allocated by the module is not fully freed on rmmod, causing a memory leak during driver removal. The vulnerability is resolved in Linux kernel code by properly freeing memory when the module is removed. The CVE has ...

CVE-2021-47303

CVE-2021-47303 affects the Linux kernel BPF subsystem. The root cause is improper lifecycle management of the poke descriptor table (aux->poke_tab) associated with BPF prog objects, which can be freed while still referenced by a map’s subprograms. This creates a use-after-free when map_poke_ru...

CVE-2021-47367

The Linux kernel contains a memory leak vulnerability in the virtio-net driver, specifically within the page_to_skb() function located in the drivers/net/virtio_net.c module. The issue occurs when building an skb in big mode ; the system fails to release unused pages chained via the private point...

CVE-2021-47437

In CVE-2021-47437, the Linux kernel IIO ADIS16475 driver is affected by a deadlock during frequency setting. The issue arose from two deadlocks introduced by the patch: (1) adis_write_reg_16() path not fully unlocked, and (2) lock not released on the success path. A fix was applied in commit 39c0...

CVE-2021-47507

CVE-2021-47507 concerns the Linux kernel nfsd startup race. The issue stems from the nsfd startup order: an RPC pipefs event race against nfsd_net_id registration, which was re-opened by commit bd5ae9288d64 and fixed by commit bb7ffbf29e76. The patch sequence restores the order между register_per...

CVE-2021-47569

CVE-2021-47569 : In the Linux kernel io_uring path, cancellation of tasks can fail for EXITING tasks when the callback runs in a fallback path. The issue is triggered during io_uring cancellation logic in fs/io_uring.c (recorded at io_try_cancel_userdata+0x3c5/0x640). The call chain shows timeout...

CVE-2022-3103

Technical details about CVE-2022-3103 are not publicly provided in the supplied documents. Monitor for updates from vendors and security advisories; current sources only note an off-by-one issue in the io_uring module without specifics.

CVE-2022-48644

Summary (CVE-2022-48644): A Linux kernel net/sched taprio offload bug could crash the kernel when disabling offload if flags were left at TAPRIO_FLAGS_INVALID after an error path. The code evaluated FULL_OFFLOAD_IS_ENABLED(q->flags) on an invalid flag value (U32_MAX), causing a crash when tapr...

CVE-2022-48787

The CVE-2022-48787 vulnerability concerns iwlwifi use-after-free in the Linux kernel. When no firmware is present or parsing fails, device_release_driver()/remove()/iwl_drv_stop() may free the drv struct, but the code can still access it. The fix involves avoiding the access after the object is f...

CVE-2022-48798

CVE-2022-48798 affects the Linux kernel (s390/cio): if a device has no attached driver or the driver lacks path_event, an FCES path-event could cause a kernel panic. The fix verifies the driver availability before the path_event call, preventing a nil-function path. The vulnerability is localized...

CVE-2022-48821

In CVE-2022-48821, the Linux kernel misc/fastrpc path fixes a use-after-free: if FASTRPC_IOCTL_ALLOC_DMA_BUFF copy-back to userland fails, the code previously called dma_buf_put() on a buffer no longer owned, risking a stale fd entry. The remediation avoids dma_buf_put() in that failure path and ...

CVE-2022-48908

CVE-2022-48908 is a Linux kernel issue affecting the arcnet com20020 PCI driver. The root cause is a null pointer dereference during com20020pci_probe() because the com20020pci_id_table may leave the card-info field empty for some devices, causing a null dereference on initialization. The provide...

CVE-2022-48927

CVE-2022-48927 refers to a Linux kernel issue in iio: adc: tsc2046 where memory corruption occurred due to an array overflow. The root cause was a mismatch: indio_dev->num_channels counted physical channels plus a timestamp channel, while the target array was allocated only for physical channe...

CVE-2022-49237

CVE-2022-49237 is resolved in the Linux kernel’s ath11k driver. The vulnerability stems from a missing of_node_put() after obtaining a device tree node via of_find_node_by_type() or of_parse_phandle(), where the node’s refcount is incremented but not decremented, causing a refcount leak. The impa...

CVE-2022-49278

CVE-2022-49278: Linux kernel remoteproc vulnerability in rproc_coredump_write() where a count underflow was possible. The fix adds a count check for zero, mirroring the validation in rproc_recovery_write(), to prevent underflow. This is resolved in the kernel codebase; patch references are in the...

CVE-2022-49450

CVE-2022-49450 relates to the Linux kernel AF_RXRPC listen() backlog handling. The underlying issue is that the backlog can be configured up to 32, but the preallocation ring has 32 slots and one slot is always dead due to the ring using CIRC_CNT(). This caused an oops on socket close when listen...

CVE-2022-49454

CVE-2022-49454 concerns the Linux kernel Mediatek PCI subsystem: a refcount leak in mtk_pcie_subsys_powerup() caused by of_find_compatible_node() returning a node pointer with an incremented refcount. The issue is resolved by adding a missing of_node_put() to release the refcount when the node is...

CVE-2022-49547

CVE-2022-49547 relates to a Linux kernel issue in btrfs where deadlocks can occur when reserving data space for direct IO writes under low free space. The deadlock involves concurrent writes to overlapping file ranges ([0,128K) and [128K,256K)) contending for the inode lock and for ordered extent...