CVE-2007-1217

CVE-2007-1217 affects the ISDN CAPI subsystem in Linux kernel 2.6.9–2.6.20 and isdn4k-utils. A buffer overflow in capiutil.c’s bufprint function could allow a local user to crash the system and potentially gain privileges via a crafted CAPI packet. Exploitation requires ISDN frame access to the t...

CVE-2008-2365

CVE-2008-2365 describes a race condition in Linux kernel ptrace/utrace support (kernel 2.6.9–2.6.25) used by RHEL4. A local user can cause a denial of service (oops) by issuing a long sequence of PTRACE_ATTACH calls that trigger a conflict between utrace_detach and report_quiescent due to a late ...

CVE-2008-2729

CVE-2008-2729 affects the Linux kernel before 2.6.19 on some AMD64 systems. The issue is in arch/x86_64/lib/copy_user.S where, after a kernel memory copy exception, destination memory locations aren’t erased, potentially letting a local user read residual data. Impact: local information disclosur...

CVE-2010-1641

CVE-2010-1641 affects the Linux kernel’s gfs2 file operations. MiracleLinux AXSA-2010-377:12 notes the affected kernel (2.6.18-194.3.AXS3) and flags that do_gfs2_set_flags does not verify file ownership, allowing local bypass via a SETFLAGS ioctl. The vulnerability corresponds to Linux kernels be...

CVE-2010-1643

CVE-2010-1643 affects the Linux kernel mm/shmem.c: when strict overcommit is enabled, export of shmemfs objects by knfsd is mishandled, allowing a denial of service via NULL pointer dereference and knfsd crash. The issue is fixed in the 2.6.28‑rc3 update (and later); affected users should upgrade...

CVE-2011-1476

CVE-2011-1476 is an integer underflow in the Linux kernel OSS subsystem (specifically the MIDI/OSS sequencer driver) before 2.6.39 on unspecified non-x86 platforms. It allows local users to cause a denial of service via memory corruption by crafting writes to /dev/sequencer. Publicly documented f...

CVE-2011-4594

The CVE-2011-4594 entry documents a local kernel vulnerability in the Linux kernel (__sys_sendmsg in net/socket.c) where crafted usage of sendmmsg can trigger an incorrect pointer dereference and crash the system. It affects kernel versions before 3.1, with the described impact being a denial of ...

CVE-2012-6539

CVE-2012-6539: In Linux kernel prior to 3.6, dev_ifconf in net/socket.c fails to initialize a structure, allowing local attackers to read kernel stack memory. SUSE advisories (SUSE-SU-2014:0536-1) roll up fixes and list this CVE among many kernel mitigations; patching/upgrading to kernel 3.6+ is ...

CVE-2012-6546

CVE-2012-6546 affects the Linux kernel up to version 3.6, where the ATM implementation may not initialize certain structures. This allows local users to obtain sensitive information from kernel stack memory via a crafted application. Connected advisories (e.g., MiracleLinux AXSA entries) confirm ...

CVE-2013-3076

CVE-2013-3076 affects the Linux kernel prior to or up to 3.9-rc8, where the crypto API does not initialize certain length variables. This allows local attackers to read kernel stack memory via crafted recvmsg/recvfrom calls, related to hash_recvmsg (crypto/algif_hash.c) and skcipher_recvmsg (cryp...

CVE-2013-7026

Summary of CVE-2013-7026 : The Linux kernel contains race conditions in ipc/shm.c (IPC_SHM with IPC_RMID) that can be exploited locally to trigger use-after-free and a system crash, potentially causing a denial of service. The issue affects kernels prior to 3.12.2. The referenced advisories indic...

CVE-2015-8953

CVE-2015-8953 affects the Linux kernel overlayfs: copy_up.c contains an incorrect cleanup path that leaks dentry references, enabling local DoS via operations on large files in a lower overlayfs layer. Affected component: overlayfs/copy_up.c in the kernel before 4.2.6. Impact: denial of service d...

CVE-2016-2066

CVE-2016-2066 affects the MSM QDSP6 audio driver in the Linux kernel 3.x as used in Qualcomm QuIC Android contributions for MSM devices and related products. The issue is an integer signedness error in the msm-audio-effects-q6-v2.c path that handles ioctl commands, leading to memory corruption. P...

CVE-2016-5400

The CVE-2016-5400 entry concerns a memory leak in the airspy_probe function of the airspy USB driver (drivers/media/usb/airspy/airspy.c) in the Linux kernel, exploitable when a crafted USB device emulates many VFL_TYPE_SDR/VFL_TYPE_SUBDEV devices and performs rapid connect/disconnect sequences. A...

CVE-2016-9777

KVM in the Linux kernel (before 4.8.12) is vulnerable when I/O APIC is enabled. A guest user can craft an interrupt request to bypass VCPU index restrictions, potentially gaining host privileges or causing a host denial of service via out-of-bounds access and host crash. Affected components: arch...

CVE-2017-0620

CVE-2017-0620 is a local elevation-of-privilege in the Qualcomm Secure Channel Manager driver on Android, allowing a malicious local app to run code in the kernel. Affected: Android devices with Kernel-3.10/3.18 (per the CVE entry). Impact per sources is High (CVSSv3: 7.0). Affected devices liste...

CVE-2017-1000377

CVE-2017-1000377 concerns a vulnerability in PAX Linux where the default stack guard page is too small and can be bypassed, allowing a bypass of stack protections. The core details indicate this affects PAX Linux kernel versions as of 19 June 2017, originally from GRSecurity and shipped by other ...

CVE-2017-18552

CVE-2017-18552 affects the Linux kernel up to version 4.10 in net/rds/af_rds.c, where rds_recv_track_latency contains an out-of-bounds write and read. The connected Nessus advisories (Unity Linux UTSA advisories) mirror this issue and reference kernel versions before 4.11, with a commit in the Li...

CVE-2017-5550

CVE-2017-5550 describes an off-by-one/error in the Linux kernel pipe_advance function (lib/iov_iter.c) that could allow local attackers to read from uninitialized kernel heap memory via a pipe, before the fixed 4.9.5 release. Connected advisories (EulerOS, Unity Linux) reference kernel versions b...

CVE-2017-8106

The CVE-2017-8106 issue affects the Linux kernel (arch/x86/kvm/vmx.c) in versions 3.12–3.15. The vulnerability arises from the handle_invept path, enabling privileged KVM guest OS users to trigger a NULL pointer dereference via a single-context INVEPT with a NULL EPT pointer, causing a denial of ...

CVE-2017-9984

The CVE-2017-9984 issue affects the Linux kernel’s snd_msnd_interrupt path (sound/isa/msnd/msnd_pinnacle.c) and is a local, double-fetch vulnerability that can allow over-boundary access to a message queue head pointer, potentially enabling DoS or other impact. The advisory notes vulnerable until...

CVE-2021-47093

CVE-2021-47093: SUSE advisories SIG- Linux kernel (SUSE SLES/openSUSE) notes a memleak in intel_pmc_core during module init when platform device registration fails. The fix frees the platform device with platform_device_put() to release resources (e.g., device name). Connected documents confirm t...

CVE-2021-47140

CVE-2021-47140 affects the Linux kernel’s IOMMU path for AMD. The root cause is that when changing the default IOMMU domain for an IOMMU group, dev->dma_ops is not cleared when switching from a DMA to an identity domain, causing the DMA layer to use dma-iommu ops on an identity domain and trig...

CVE-2021-47300

CVE-2021-47300 concerns a Linux kernel issue in BPF tail calls where tail_call_reachable was not propagated correctly in the interpreter when JIT failed. The root cause, described across multiple sources, is that a previous rejection path (from commits like e411901c0b77) incorrectly left env->...

CVE-2021-47363

The CVE-2021-47363 issue is a Linux kernel vulnerability in the nexthop path where a resilient nexthop group could cause a division by zero when a stub nh_res_table with zero buckets is assigned during replacement while traffic is flowing. Roots cause: the data path could still reference the old ...

CVE-2021-47528

CVE-2021-47528 in the Linux kernel USB CDNSP code fixes a NULL pointer dereference in cdnsp_endpoint_init() by adding a check for pep->ring after cdnsp_ring_alloc() (previously dereferenced on potential failure). The vulnerability could occur when cdnsp_ring_alloc() fails and pep->ring is N...

CVE-2022-48640

The CVE-2022-48640 entry documents a NULL dereference in the Linux kernel bonding subsystem. Root cause: when a bond is created with an initial mode other than Round Robin (mode != 0), the memory for the bonding.rr_tx_counter is not allocated, so switching modes later does not verify allocation, ...

CVE-2022-48707

CVE-2022-48707 (Linux kernel, cxl/region) : The issue arises when destroying a region that includes a host bridge with a single root port and a decoupled HDM/CXL device, where the region driver creates a special pass-through decoder without a commit/reset callback. Before the fix, the ->reset(...

CVE-2022-48749

CVE-2022-48749 affects the Linux kernel (drm/msm/dpu) where dpu_setup_dspp_pcc performs a check on the ctx parameter but uses it prior to the check. The issue is a potential NULL pointer dereference, mitigated by initializing the base variable after the sanity check. The vulnerability is describe...

CVE-2022-48780

CVE-2022-48780 (Linux kernel) : The vulnerability in net/smc arises from overwriting clcsock callback function pointers during multiple fallbacks, which can create a loop: clcsk->sk_error_report → smc_fback_error_report → smc_fback_forward_wakeup → clcsock_callback overwritten → smc->clcsk_...

CVE-2022-48813

CVE-2022-48813 concerns the Linux kernel’s DSA Felix support. The advisory notes that using devres for the MDIO bus caused mdiobus_free() to panic when freed via devm_mdiobus_free(), unless the bus was unregistered first. For the Felix VSC9959 switch (PCI device), the recommended remediation is t...

CVE-2022-48848

CVE-2022-48848 affects the Linux kernel tracing/osnoise workflow. Concrete detail: the issue is caused by unregistering tracepoints twice when stopping tracing (osnoise_workload_stop) and switching tracer to nop, leading to a kernel warning about unregistering an unregistered tracepoint. The conn...

CVE-2022-48892

CVE-2022-48892 : Linux kernel sched/core fix for a use-after-free in dup_user_cpus_ptr(). The vulnerability existed due to dup_user_cpus_ptr() accessing user_cpus_ptr without proper locking, racing with fork() and the clearing of user_cpus_ptr during set_cpus_allowed_ptr_locked(), primarily affec...

CVE-2022-49210

The CVE-2022-49210 issue is a Linux-kernel memory-leak in the MIPS pgalloc path. The generic pgd_free() freed only one pgd page, but on 64‑bit systems with PAGE_SIZE_4KB and without MIPS_VA_BITS_48 the PGD_TABLE spans two pages; this mismatch leaks memory. MemFree behavior can reveal the leak. Ro...

CVE-2022-49380

The CVE-2022-49380 entry concerns a Linux kernel F2FS bug where total_valid_block_count/total_valid_node_count could fuzz to zero, leading to a BUG_ON() during dec_valid_node_count() in f2fs_remove_inode_page()/f2fs_evict_inode(). The issue was fixed by printing a warning and changing behavior to...

CVE-2022-49428

The CVE-2022-49428 entry concerns Linux kernel f2fs: the fix adds a sanity check for inline_dots in inodes to prevent a NULL pointer dereference during f2fs_lookup (__recover_dot_dentries path). The root cause is that for special files (character, block, fifo, socket), f2fs did not initialize the...

CVE-2022-49454

CVE-2022-49454 concerns the Linux kernel Mediatek PCI subsystem: a refcount leak in mtk_pcie_subsys_powerup() caused by of_find_compatible_node() returning a node pointer with an incremented refcount. The issue is resolved by adding a missing of_node_put() to release the refcount when the node is...

CVE-2022-49796

The CVE-2022-49796 issue affects the Linux kernel tracing/kprobe path. It concerns a potential NULL pointer dereference in trace_array if test_gen_kprobe_cmd() fails after kprobe_event_gen_cmd_end(), where gen_kretprobe_test could reference an invalid trace_array after kprobe_event_delete(). The ...

CVE-2022-49937

CVE-2022-49937 affects the Linux kernel mceusb driver in the media subsystem. Automatic fuzzing reported a WARN due to an unusual read on endpoint 0 caused by using legacy usb_control_msg_() routines and not setting USB_DIR_IN in bRequestType. The fix converts the driver to usb_control_msg_recv()...

CVE-2022-49968

CVE-2022-49968 concerns the Linux kernel driver ieee802154/adf7242. The race is a use-after-free between adf7242_remove (which cancels delayed work and may destroy the workqueue) and adf7242_channel (which could run during or after destruction). The root cause is that the upper layer may detach w...

CVE-2022-49980

CVE-2022-49980 affects the Linux kernel USB gadget subsystem (udc). A race between uevent callbacks and gadget driver unregistration can cause a use-after-free in usb_udc_uevent(), when it dereferences udc->driver without holding the udc_lock mutex. If the gadget driver is unbound concurrently...

CVE-2022-49982

CVE-2022-49982 affects the Linux kernel media driver pvrusb2. The leak arises from error handling in pvr2_hdw_create: the v4l2 device is not unregistered when control flow returns to pvr2_context_create, causing pvr2_hdw_destroy to exit early. The fix adds v4l2_device_unregister to decrement the ...

CVE-2022-50016

CVE-2022-50016 concerns the Linux kernel ASoC SOF Intel cnl driver. The issue arises when an IPC reply is processed before the FW_READY message, risking a NULL pointer dereference because reply_data is allocated only after FW_READY. The description notes this condition was observed with IPC4 firm...

CVE-2022-50027

CVE-2022-50027 is a Linux kernel issue affecting the SCSI lpfc path, where a missing free for the iocbq on failure to issue the CMF WQE can cause a memory leak. The root cause is that if lpfc_sli4_issue_wqe fails (ret_val non-zero), the iocbq request structure is not consistently freed, leading t...

CVE-2022-50144

CVE-2022-50144 relates to the Linux kernel SoundWire subsystem. The issue arises during bind/unbind of SoundWire drivers where the probe stores driver ops in a per-slave structure and a previously introduced probed/probe_complete state isn’t reset on removal, enabling risky callbacks after .remov...

CVE-2022-50179

CVE-2022-50179 concerns a use-after-free in the Linux kernel’s ath9k driver, specifically in ath9k_hif_usb_rx_cb. The issue stems from incorrect initialization of htc_handle->drv_priv, which can be freed and leaked during a probable call trace that starts at ath9k_htc_probe_device and leads to...

CVE-2023-52779

CVE-2023-52779 describes a Linux kernel issue where vfs_getattr_nosec() could end up invoking vfs_getattr() in certain filesystems (notably overlayfs and ecryptfs), which could lead to a NULL pointer dereference due to security_inode_getattr() on a process with no current->fs. The patch introd...

CVE-2023-52795

Summary: CVE-2023-52795 affects the Linux kernel vhost-vdpa path. The vulnerability is a use-after-free/double-free in vhost_vdpa_probe() caused by put_device() calling vhost_vdpa_release_dev() which frees a device via ida_simple_remove(). This was resolved in the Linux kernel; the Astra Linux ad...

CVE-2023-52839

CVE-2023-52839 describes a Linux kernel vulnerability in perf where broadcasting to other CPUs when starting a counter was removed as part of a fix (commit 3fec323339a4). Root cause: unnecessary broadcast in perf code could lead to a warning and potential instability; fix eliminates the broadcast...

CVE-2023-52893

Summary: CVE-2023-52893 is a Linux kernel vulnerability where a call path using get_variable with a NULL attr triggers a null-deref/panic in the gsmi subsystem. Root cause: The patch accompanying the EFI varstore change (efi: pstore: Omit efivars caching EFI varstore access layer) added a new get...