CVE-2022-50101

CVE-2022-50101 affects the Linux kernel’s fbdev vt8623fb code. The flaw arises in vt8623fb_set_par(), where a user-supplied value is used to compute screen_size. If screen_size exceeds info->screen_size, a memory write via memset_io() can trigger a supervisor-page fault (kernel crash). The rep...

CVE-2023-20811

CVE-2023-20811 involves a boundary-check failure in the MediaTek IOMMU, causing an out-of-bounds write that could enable local privilege escalation with system privileges. Affected component: IOMMU sub-system (MediaTek). Root cause: missing bounds check leading to out-of-bounds write. Impact: loc...

CVE-2023-52688

CVE-2023-52688 affects the Linux kernel wifi driver ath12k, where an error path in the core rfkill config fail path did not free allocated resources. The issue could cause resource leaks by not destroying the core pdev when rfkill config initialization fails. The accompanying fix adds a call to c...

CVE-2023-53030

CVE-2023-53030 affects the Linux kernel in octeontx2-pf where GFP_KERNEL was used in a context with preemption disabled, triggering a warning (CONFIG_DEBUG_ATOMIC_SLEEP) and potential sleeping in atomic context. The issue is resolved by avoiding GFP_KERNEL in atomic contexts and disabling preempt...

CVE-2024-26847

CVE-2024-26847 concerns the Linux kernel on POWER platforms where RTAS function names were spelled inconsistently. The PAPR-specified name is ibm,reset-pe-dma-windows, but firmware in practice used ibm,reset-pe-dma-window in the device tree. This mismatch caused reverse lookups (token -> name)...

CVE-2024-36970

CVE-2024-36970 : In the Linux kernel, the issue affects the iwlwifi subsystem and has been resolved by changing the module load path to use request_module_nowait, which is described as a workaround for a deadlock regression introduced during LED merging in 6.9. The deadlock is observed in systems...

CVE-2024-41018

CVE-2024-41018 affects the Linux kernel NTFS-3 driver (fs/ntfs3). The issue is an out-of-bounds condition triggered by ATTR_NAME_ENTRY during attr_names/oatbl processing, leading to potential memory access issues. A patch adds out-of-bounds checking for the *ane entry, and commits referenced in c...

CVE-2024-41054

CVE-2024-41054 is a Linux kernel vulnerability in the SCSI/UFS subsystem (ufshcd_clear_cmd racing with the completion ISR). The race can lead to a NULL pointer dereference when the ISR completes a request, with a backtrace showing blk_mq_unique_tag and ufshcd_clear_cmd paths in the ufshc_mediatek...

CVE-2024-42266

CVE-2024-42266 affects the Linux kernel’s btrfs module, specifically the cow_file_range_inline path. The issue stems from improper handling of return values in __extent_writepage()/extent_writepage paths, where a folio could be unlocked on error, triggering a kernel panic (folio_test_locked) duri...

CVE-2024-42275

Summary of CVE-2024-42275 : In the Linux kernel DRM subsystem, the bug is in the drm_client_buffer_vmap_local() function (drivers/gpu/drm/drm_client.c). The function can return zero on the failure path, which causes locking issues and leaves the caller’s _map_copy uninitialized. This is a local, ...

CVE-2024-43838

CVE-2024-43838 affects the Linux kernel BPF path. The root cause is an incorrect overflow check in adjust_jmp_off(), where insn->imm was used for all overflow checks instead of insn->off for the general jump case. The issue is resolved by using insn->off for the overflow check in the gen...

CVE-2024-44976

MODE C: CVE-2024-44976 involves the Linux kernel pata_macio driver (ata/pata_macio) where a change to max_segment_size to 64KB caused DMA table overflow on large SG lists, leading to kernel BUGs on 32-bit PowerMacs. The issue arises when oversized requests trigger the split logic, overflowing the...

CVE-2024-46789

CVE-2024-46789 (Linux kernel) details from connected documents show a concrete fix: in mm/slub, the tagging logic now checks s->flags in alloc_tagging_slab_free_hook to avoid calling alloc_tag_add when SLAB_NO_OBJ_EXT or SLAB_NOLEAKTRACE are set. This prevents the NULL ref (ref->ct) and the...

CVE-2024-50241

CVE-2024-50241 affects the Linux kernel NFSD/NFSv4 path. The vulnerability stems from not initializing struct nfsd4_copy’s refcount and async_copies early enough, so cleanup_async_copy() may reference uninitialized fields if nfsd4_copy() errors, risking a refcount underflow. The connected documen...

CVE-2024-53235

The CVE-2024-53235 entry documents a Linux kernel issue where erofs file-backed mounts over FUSE caused a null pointer dereference in fuse_read_args_fill during reads (fuse_read_folio path), potentially affecting read I/O that requires valid file pointers on certain network/FUSE filesystems. The ...

CVE-2025-21824

Technical details about CVE-2025-21824 are not publicly available in the provided connected documents; no vendor/product specifics or mitigations are provided. Monitor for updates.

CVE-2025-38006

CVE-2025-38006 affects the Linux kernel MCTP path: in net/mctp, mctp_dump_addrinfo may read uninitialized memory from ifaddrmsg when filtering by ifa_index if the struct isaddrmsg is not provided. This can occur during certain netlink dumps (e.g., from syzkaller/busybox ip addr show). The issue i...

CVE-2025-38273

CVE-2025-38273 affects the Linux kernel TIPC net subsystem. The root cause was a refcount handling issue where get_net() could be invoked on a network namespace already being destroyed, triggering a use-after-free warning when a TIPC discovery timer fires during namespace cleanup. The fix replace...

CVE-2025-38355

CVE-2025-38355 involves the Linux kernel DRM/xe path where deferred GGTT node removals could be drained later than device unwinding, potentially unmapping MMIO/GSM mappings during unwinding and causing a page fault. The fixes add a managed-device action to explicitly drain the ggtt node removals ...

CVE-2025-38496

CVE-2025-38496 concerns the Linux kernel and relates to the dm-bufio component. The issue occurs when the DM_BUFIO client is configured with NO_SLEEP and verity integration, where buffer eviction could trigger scheduling in spin_lock_bh, potentially leading to a sleeping operation in an atomic co...

CVE-2004-1058

CVE-2004-1058 is a race-condition vulnerability in the Linux kernel that can allow a local user to read environment variables of another process that is still spawning via /proc/.../cmdline. The initial description specifies Linux kernel 2.6 as affected. Connected advisories confirm this CVE is r...

CVE-2005-2459

CVE-2005-2459 affects the Linux kernel prior to 2.6.12.5, where the huft_build function in inflate.c of the zlib routines returns the wrong value. This bug allows remote attackers to crash the kernel via a specially crafted compressed file, causing a null pointer dereference (a denial of service)...

CVE-2005-2553

CVE-2005-2553 affects Linux kernel 2.4.x before 2.4.29, where a NULL pointer dereference in ptrace32.c's find_target can crash the kernel when tracing a 64-bit executable with 32-bit ltrace. The vulnerability is local and may lead to a kernel oops/crash. Public advisories in connected docs (e.g.,...

CVE-2005-2709

The CVE-2005-2709 issue affects the Linux kernel's sysctl.c in kernels prior to 2.6.14.1. Local users could exploit a window created by opening an interface file under /proc/sys/net/ipv4/conf/, wait for the interface to unregister, then read/modify function pointers in memory used for the ctl_tab...

CVE-2005-2800

CVE-2005-2800 is a memory leak in the Linux kernel's SCSI procfs sg(devices) interface (for Linux 2.6.13 and earlier). Exploitation arises from repeated reads of /proc/scsi/sg/devices, leading to memory consumption and potential Denial of Service. Publicly documented references describe the issue...

CVE-2005-2872

The CVE pertains to the ipt_recent kernel module (ipt_recent.c) in Linux kernels before 2.6.12. On 64-bit CPUs (e.g., AMD64), remote attackers can trigger a kernel panic (DoS) via SSH brute-force-style inputs, due to a length argument based on u_int32_t operating on an array of unsigned long elem...

CVE-2005-3105

CVE-2005-3105 affects the Linux kernel 2.6 on Itanium IA-64 Montecito (IA-64) where the mprotect code may lose cache coherency, enabling local users to cause a denial of service and possibly corrupt data by modifying PTE protections. Public advisories in connected documents (e.g., Debian DSA-922,...

CVE-2005-3107

CVE-2005-3107 affects the Linux kernel 2.6 family, where a local attacker tracing a thread that shares the same memory map can cause a denial of service (deadlock) by forcing a core dump when the traced thread is in TASK_TRACED. Public advisories (e.g., RHSA-2006:0437, CESA-2006:0437) document th...

CVE-2005-3274

CVE-2005-3274 is a race condition in the Linux kernel’s SMP path for ip_vs_conn_flush, where a connection timer can expire while the connection table is being flushed before the correct lock is held. Affects Linux 2.6.x (before 2.6.13) and 2.4.x (before 2.4.32-pre2). Local users could trigger a n...

CVE-2007-5498

The CVE-2007-5498 issue affects the Xen hypervisor block backend driver for Linux kernel 2.6.18. When running on a 64-bit host with a 32-bit paravirtualized guest, a local privileged user in the guest can trigger a denial of service (host OS crash) by issuing a request that specifies a very large...

CVE-2008-3526

CVE-2008-3526 is a Linux kernel SCTP vulnerability present in 2.6.24-rc1 through 2.6.26.3. The issue is an integer overflow in sctp_setsockopt_auth_key (net/sctp/socket.c) that can be triggered by a crafted sca_keylength field in the SCTP_AUTH_KEY option, allowing remote attackers to cause a deni...

CVE-2008-3792

CVE-2008-3792 affects the Linux kernel SCTP path: net/sctp/socket.c does not verify that the SCTP-AUTH extension is enabled before invoking SCTP-AUTH API functions. This can cause a denial of service (NULL pointer dereference/panic) via calls such as sctp_setsockopt_auth_chunk, sctp_setsockopt_hm...

CVE-2010-1162

CVE-2010-1162 affects the Linux kernel before 2.6.34-rc4, in which release_one_tty() in drivers/char/tty_io.c omits certain required put_pid() calls. The impact is described as unspecified, with local attack vectors. The available connected documents confirm the vulnerability and reference the af...

CVE-2010-2525

CVE-2010-2525 involves a flaw in the gfs2 file system’s handling of ACLs. An unprivileged local attacker could exploit this to gain access to, or execute any file stored in, the gfs2 filesystem. The description and multiple connected advisories (Red Hat, SUSE, Ubuntu/NVD references) corroborate t...

CVE-2013-0290

The vulnerability CVE-2013-0290 affects the Linux kernel up to version 3.7.x (fixed in 3.8) and is due to how __skb_recv_datagram() in net/core/datagram.c handles MSG_PEEK when data length is zero. A local unprivileged user can trigger an infinite loop, causing a denial of service (system hang). ...

CVE-2013-1958

CVE-2013-1958 affects Linux kernels before 3.8.6 where scm_check_creds in net/core/scm.c fails to enforce capabilities for the PID value tied to a UNIX domain socket, allowing local users to bypass access controls during a window when a user namespace exists but a PID namespace is not yet created...

CVE-2013-4513

Buffer overflow in the oz_cdev_write function of drivers/staging/ozwpan/ozcdev.c in the Linux kernel before 3.12 allows local users to cause a denial of service or possibly other impact via a crafted write. A fix is provided by Linux kernel 3.12+ (patches referenced in the linked advisory), so up...

CVE-2013-4516

CVE-2013-4516 affects the Linux kernel: the mp_get_count function in drivers/staging/sb105x/sb_pci_mp.c before 3.12 does not initialize a data structure, enabling local users to read sensitive data from kernel stack memory via a TIOCGICOUNT ioctl. Reports reference the specific vulnerable code pa...

CVE-2014-7207

CVE-2014-7207 affects the Linux kernel IPv6 implementation (3.2.x–3.2.63). The issue stems from improper validation in ipv6_select_ident function calls, permitting local users to trigger a NULL pointer dereference and system crash via tun or macvtap device access. Connected advisories confirm Deb...

CVE-2015-4178

Technical details about CVE-2015-4178 are not publicly provided in the connected documents. The materials reference the vulnerability generally; monitor for updates from official advisories.

CVE-2021-47128

CVE-2021-47128 affects the Linux kernel’s SELinux lockdown integration (locked_down LSM hook). The vulnerability stems from buggy SELinux lockdown permission checks in the interaction between bpf/audit pathways and the lockdown checks, which can trigger problematic audit logging and deadlocks. Ex...

CVE-2021-47195

CVE-2021-47195 relates to the Linux kernel SPI subsystem. The issue is a use-after-free caused by unlocking a per-controller mutex (add_lock) after the controller has already been freed during spi_unregister_controller(ctlr) and subsequent put_device flow. The fix moves put_device() after the mut...

CVE-2021-47272

The CVE-2021-47272 item concerns a Linux kernel issue in the DWC3 gadget path. A failure in dwc3_gadget_init() can leave dwc->gadget dangling and lead to dereferencing an invalid gadget pointer or freeing unmapped DMA memory during mode switches peripheral/host. The root cause is an unsafe ref...

CVE-2021-47300

CVE-2021-47300 concerns a Linux kernel issue in BPF tail calls where tail_call_reachable was not propagated correctly in the interpreter when JIT failed. The root cause, described across multiple sources, is that a previous rejection path (from commits like e411901c0b77) incorrectly left env->...

CVE-2021-47508

CVE-2021-47508 affects the Linux kernel’s btrfs code path. The issue is a memory leak: when qgroup/data reservation fails in btrfs_check_data_free_space() or btrfs_delalloc_reserve_space(), the allocated extent_changeset is not freed. This occurs specifically in the direct IO write path (and rela...

CVE-2021-47532

CVE-2021-47532 concerns a leak in the Linux kernel related to the DRM MSM devfreq OPP reference counter. The vulnerability is described as a local issue in the kernel’s OPP handling that could leak references in the OPP (Operating Performance Point) management path within the drm/msm/devfreq subs...

CVE-2021-47601

CVE-2021-47601 in the Linux kernel fixes a NULL dereference caused by an IS_ERR() vs NULL check in the tee: amdtee path; __get_free_pages() returns NULL, not an error pointer. Affects Linux kernel; fix implemented in kernel updates (Unity Linux UTSA-2025-988866 and SUSE advisories SUSE-SU-2024:29...

CVE-2022-48722

CVE-2022-48722 affects the Linux kernel, specifically the net/ieee802154: ca8210 path. On error, the helper ieee802154_xmit_complete() is not invoked and only ieee802154_wake_queue() is called, which can leak an skb. The remediation is to free the skb structure upon error before returning. Multip...

CVE-2022-48725

CVE-2022-48725: Linux kernel RDMA/siw: fix refcounting leak in siw_create_qp by ensuring atomic_inc() is paired with atomic_dec() on the error path. The issue allows a leak on error handling during QP creation; remediation is a kernel patch (e.g., commits listed in the references) that corrects t...

CVE-2022-48774

CVE-2022-48774 affects the Linux kernel dmaengine/ptdma path. The issue is in pt_core_init() where resource freeing in the error path could leak resources or release unallocated items. The fix switches two goto targets in the error handling path to ensure proper resource cleanup, and relocates a ...