CVE-2023-52795

Summary: CVE-2023-52795 affects the Linux kernel vhost-vdpa path. The vulnerability is a use-after-free/double-free in vhost_vdpa_probe() caused by put_device() calling vhost_vdpa_release_dev() which frees a device via ida_simple_remove(). This was resolved in the Linux kernel; the Astra Linux ad...

CVE-2024-36970

CVE-2024-36970 : In the Linux kernel, the issue affects the iwlwifi subsystem and has been resolved by changing the module load path to use request_module_nowait, which is described as a workaround for a deadlock regression introduced during LED merging in 6.9. The deadlock is observed in systems...

CVE-2024-40933

The CVE-2024-40933 entry concerns a Linux kernel IIO temperature driver mlx90635 issue. The vulnerability arises in mlx90635_probe() where a failure of devm_regmap_init_i2c() could yield regmap_ee as an error pointer rather than being checked with IS_ERR(regmap_ee), effectively a copy-paste error...

CVE-2024-40951

CVE-2024-40951 affects the Linux kernel (OCFS2 subsystem). The issue is a NULL pointer dereference in ocfs2_abort_trigger() caused by bdev->bd_super removal and an incorrect use of bh->b_assoc_map without proper initialization, leading to a crash when the function is invoked. The provided s...

CVE-2024-40955

CVE-2024-40955 corresponds to a Linux kernel ext4 slab-out-of-bounds in ext4_mb_find_good_group_avg_frag_lists, triggered by setting mb_group_prealloc to a very large value (2147483647) and performing specific mkfs/mount/write actions. The bug is in ext4’s block allocation logic (mb_alloc/mb_grou...

CVE-2024-53186

CVE-2024-53186 : Linux kernel ksmbd race condition causing use-after-free in SMB request handling. The issue is between ksmbd_conn_handler_loop() waiting for conn->r_count to reach zero and handle_ksmbd_work() decrementing and freeing the ksmbd_conn, after which the code may still touch conn-&...

CVE-2025-21803

CVE-2025-21803: In LoongArch, the Linux kernel fixed a warning during S3 suspend by removing a potential thread switch in enable_gpe_wakeup. Root cause was acpi_enable_all_wakeup_gpes() using a mutex, which could yield and leave the CPU interrupt-enabled state when enable_gpe_wakeup() returns. Th...

CVE-2025-21842

The CVE-2025-21842 entry concerns amdkfd in the Linux kernel where gang_ctx_bo memory is not freed correctly when user-queue init fails. The destructor for a gtt BO is declared as void amdgpu_amdkfd_free_gtt_mem(struct amdgpu_device adev, void mem_obj), taking a void . GCC will implicitly allow p...

CVE-2025-38012

The CVE-2025-38012 issue affects Linux kernel sched_ext: bpf_iter_scx_dsq_new() may leave an uninitialized iterator after an error, causing bpf_iter_scx_dsq_next() to dereference garbage data. The documented fix is to always clear kit->dsq in bpf_iter_scx_dsq_new(), so that next() and destroy(...

CVE-2025-38114

CVE-2025-38114 : In the Linux kernel, a deadlock could occur in the e1000 path due to e1000_down calling cancel_work_sync for the e1000_reset_task while RTNL is held. The fix moves cancel_work_sync to happen when the device is being removed (not during normal down), and makes e1000_reset_task a n...

CVE-2025-38528

CVE-2025-38528: Linux kernel BPF format-string vulnerability in bprintf-like helpers. Root cause: bpf_bprintf_prepare incorrectly skips the second % in %p% during processing, allowing a risky %\x00 to reach the format decoder. The patch changes behavior to not skip punctuation, causing the invali...

CVE-2025-38550

CVE-2025-38550 is a Linux kernel issue in ipv6 multicast handling. The root cause is delaying the release of the reference to pmc->idev in mld_del_delrec(), while pmc->idev is also used by ip6_mc_clear_src(). The fix (as stated) is to put the reference after ip6_mc_clear_src() returns. The ...

CVE-2025-38576

CVE-2025-38576 affects the Linux kernel PowerPC EEH hotplug path. Root cause: race conditions between the PCIe hotplug driver and the EEH driver can yield kernel oops during unplug/recovery cycles and bus disappearance. Resolution: refactor the EEH module to be PCI rescan and remove safe, with cl...

CVE-2025-38623

The CVE-2025-38623 entry describes a Linux kernel fix in PCI: pnv_php hotplug handling. The vulnerability stemmed from improper handling of surprise plug events, enabling a PE bridge to freeze MSI interrupt paths and leaving PHB/PE in a frozen state after removal. Consequences include stalled plu...

CVE-2025-39744

The CVE-2025-39744 issue affects the Linux kernel and describes a deadlock in rcu_read_unlock() when called during irq_exit() if an IPI is issued. The root cause is an incorrect handling of irq_work state inside rcu_read_unlock_special() triggered by irq_exit(), which can cause a system hang/lock...

CVE-2025-39760

CVE-2025-39760 concerns the Linux kernel USB subsystem: usb_parse_ss_endpoint_companion() previously read descriptor fields without ensuring the descriptor length, enabling an out-of-bounds read in SS endpoint companion parsing. The fixed code now checks the size before accessing descriptor field...

CVE-2026-23213

CVE-2026-23213 affects the Linux kernel’s DRM/AMD/PM path. During an SMU Mode 1 reset, the ASIC goes through a reset cycle and becomes temporarily inaccessible via PCIe, risking uncompleted PCIe transactions that can trigger NMI panics or system hangs. The fix disables MMIO access during the offl...

CVE-2026-31508

The CVE-2026-31508 issue affects the Linux kernel in the Open vSwitch teardown path. The root cause is that after a patch, the teardown code for OVS ports no longer unconditionally takes the RTNL, allowing netdev_destroy() to finish and free the netdev before unregistration completes if the IFF_O...

CVE-2026-46241

CVE-2026-46241 concerns the SPI driver for the MPC52xx in the Linux kernel, where a use-after-free can occur if controller registration fails because interrupts are not properly disabled and freed. The issue is resolved by a fix that ensures interrupts are disabled and resources freed on registra...

CVE-2026-53091

The CVE-2026-53091 issue concerns the Linux kernel’s handling of GSO packet headers during qdisc_pkt_len_segs_init(). The root cause is that many ndo_start_xmit() paths assume headers are already in skb->head, while tso_build_hdr() may copy from skb->data, and qdisc_pkt_len_segs_init() diss...

CVE-2026-53355

CVE-2026-53355 is a Linux kernel issue in the RDS teardown path (i_sends) that could interact with partial startup/shutdown states. Connected sources confirm concrete fixes across distributions: Root’s OS variants (Ubuntu 24.04 and others) list Root:Ubuntu patches for Root:Ubuntu-2404 and related...

CVE-2026-64266

CVE-2026-64266 affects the Linux kernel fuse subsystem. The vulnerability stems from fuse_ref_folio() unlocking the request but not re-locking before return, allowing fuse_chan_abort() to end the request and for the async end callback to free args while the copy chain later accesses them, causing...

CVE-2026-64423

CVE-2026-64423 affects the Linux kernel IPv4 IGMP multicast handling. The root cause is that, when a device is destroyed, ip_mc_destroy_dev() decrements the multicast membership refcount but fails to unlink the membership from the device’s multicast hash table (mc_hash) before RCUs reclaim the ob...

CVE-1999-0381

CVE-1999-0381 affects the syslog utility in super 3.11.6 and other versions, where a buffer overflow allows a local user to gain root privileges. The issue originates from the syslog component, with the impact described as local privilege escalation (root). Available connected documents confirm t...

CVE-2004-0001

The CVE-2004-0001 issue is described across multiple advisories as a local privilege escalation in the AMD64 Linux kernel ptrace emulation, due to incorrect eflags handling in 32-bit ptrace. Affected: AMD64 Linux kernels; root cause: eflags processing in the ptrace emulation path; impact: local u...

CVE-2004-0427

The CVE-2004-0427 issue affects Linux kernels: do_fork in 2.4.x prior to 2.4.26 and 2.6.x prior to 2.6.6 fails to decrement mm_count when an error occurs after activating the child mm_struct, causing a memory leak and a local denial-of-service via CLONE_VM. The description specifies the root caus...

CVE-2004-1068

CVE-2004-1068 involves a missing serialization flaw in the unix_dgram_recvmsg path of Linux kernels 2.4.27 and earlier, and 2.6.x up to 2.6.9. The issue enables local users to potentially gain privileges due to a race condition. The description explicitly states the vulnerability is a local privi...

CVE-2005-3276

CVE-2005-3276 affects the Linux 2.6 kernel: the sys_get_thread_area path in process.c may copy an uninitialized data structure to userspace, exposing kernel memory to a local user. Affected versions are 2.6 before 2.6.12.4 and 2.6.13. The impact is information disclosure of kernel data to untrust...

CVE-2005-3660

CVE-2005-3660 affects the Linux kernel 2.4.x and 2.6.x. The vulnerability occurs when a process creates a large number of connected file descriptors or socketpairs and uses a large data transfer buffer, which can exhaust memory and cause a kernel panic or denial of service. The underlying issue c...

CVE-2006-1856

CVE-2006-1856 is a confirmed issue in the Linux kernel up to 2.6.8 where the readv and writev LSM hooks could be bypassed due to a missing file_permission check. The Debian advisory DSA-1184-2 and related distributions (e.g., Ubuntu USN-302-1) document this as one of several vulnerabilities fixed...

CVE-2006-2936

CVE-2006-2936 affects the ftdi_sio USB/serial driver in Linux kernels 2.6.x (up to at least 2.6.17). The issue lets local users trigger memory consumption DoS by writing more data to a serial port than the hardware can handle, causing queued data and potential resource exhaustion. Public referenc...

CVE-2006-5753

The CVE-2006-5753 issue concerns the Linux kernel: a flaw in the listxattr system call that can be exploited when a bad inode is present. Local users may cause a denial of service (data corruption) and potentially escalate privileges. Supported documents indicate this vulnerability was addressed ...

CVE-2008-3534

CVE-2008-3534 affects the Linux kernel tmpfs implementation (shmem.c: shmem_delete_inode). A local attacker could crash the system by a specific sequence of file create/remove/overwrite operations, linked to allocation of “useless pages” and improper maintenance of i_blocks. Public advisories con...

CVE-2013-0290

The vulnerability CVE-2013-0290 affects the Linux kernel up to version 3.7.x (fixed in 3.8) and is due to how __skb_recv_datagram() in net/core/datagram.c handles MSG_PEEK when data length is zero. A local unprivileged user can trigger an infinite loop, causing a denial of service (system hang). ...

CVE-2013-2896

The CVE-2013-2896 issue affects the Linux kernel HID driver: drivers/hid/hid-ntrig.c, applicable when CONFIG_HID_NTRIG is enabled, up to kernel version 3.11. It allows physically proximate attackers to trigger a denial of service (NULL pointer dereference and OOPS) via a crafted HID device. Explo...

CVE-2013-3076

CVE-2013-3076 affects the Linux kernel prior to or up to 3.9-rc8, where the crypto API does not initialize certain length variables. This allows local attackers to read kernel stack memory via crafted recvmsg/recvfrom calls, related to hash_recvmsg (crypto/algif_hash.c) and skcipher_recvmsg (cryp...

CVE-2014-8481

CVE-2014-8481 affects the Linux kernel KVM arch/x86/kvm/emulate.c; the instruction decoder mishandles invalid instructions, allowing guest OS users to trigger a NULL pointer dereference and host crash via a crafted application that either fetches an invalid instruction or uses too many bytes. Roo...

CVE-2015-0572

The CVE-2015-0572 entry concerns the ADSPRPC driver for the Linux kernel (drivers/char/adsprpc.c and drivers/char/adsprpc_compat.c) used in Qualcomm QuIC MSM Android contributions and other devices. The issue is a race condition that can be exploited via the COMPAT_FASTRPC_IOCTL_INVOKE_FD ioctl, ...

CVE-2016-2068

The CVE-2016-2068 issue affects the MSM QDSP6 (sound) driver in the Linux kernel 3.x, used in Qualcomm QuIC Android contributions. The vulnerability arises in the driver when handling AUDIO_EFFECTS_WRITE (or AUDIO_EFFECTS_READ) operations, due to integer overflow and potential buffer overflow or ...

CVE-2017-0568

CVE-2017-0568 is a Broadcom Wi‑Fi driver elevation-of-privilege issue in Android kernels (3.10/3.18). An attacker controlling the dongle can abuse WLC_GET_VALID_CHANNELS results to inflate list->count, causing an out‑of‑bounds write when populating default_chan_list and enabling arbitrary code...

CVE-2017-9984

The CVE-2017-9984 issue affects the Linux kernel’s snd_msnd_interrupt path (sound/isa/msnd/msnd_pinnacle.c) and is a local, double-fetch vulnerability that can allow over-boundary access to a message queue head pointer, potentially enabling DoS or other impact. The advisory notes vulnerable until...

CVE-2021-47164

CVE-2021-47164 is a Linux kernel vulnerability fixed by correcting a NULL dereference in net/mlx5e related to lag device handling. Explanation: in bond_enslave(), the active/backup slave was set before the upper dev is assigned; a second event with an upper dev can occur, and if lag dev is NULL a...

CVE-2021-47199

The CVE-2021-47199 issue in the Linux kernel's mlx5e CT offload layer causes a memleak of mod hdr actions due to CT clear action offload flow handling. Specifically, CT clear action offload adds the same set of mod hdr actions to reset ct_state when an encap action is present, potentially repeati...

CVE-2021-47264

The CVE-2021-47264 issue is tied to the Linux kernel ASoC core code, where a null pointer dereference in fmt_single_name() could occur if the return value of devm_kstrdup() is not checked. The connected documents confirm the vulnerability and indicate that it has been resolved by adding a check o...

CVE-2021-47286

CVE-2021-47286 affects the Linux kernel MHI bus core. The issue arises when processing command completions: the channel ID read from the device event ring can be any value 0–255, risking out-of-bounds accesses. The fix adds a bounds check against the controller’s maximum channels and against chan...

CVE-2021-47292

CVE-2021-47292 affects the Linux kernel io_uring subsystem. The issue is a memory leak in io_init_wq_offload() where a leaked hash_map can occur when io_uring_enter() is called in parallel (syz-executor traffic). Root cause: missing synchronization around kzalloc/hash_map updates in io_init_wq_of...

CVE-2021-47300

CVE-2021-47300 concerns a Linux kernel issue in BPF tail calls where tail_call_reachable was not propagated correctly in the interpreter when JIT failed. The root cause, described across multiple sources, is that a previous rejection path (from commits like e411901c0b77) incorrectly left env->...

CVE-2021-47336

CVE-2021-47336 affects the Linux kernel via the smackfs path: the function smk_set_cipso() incorrectly handles a bytes-count restriction, due to a mistaken cross-check that applied only to the SMK_FIXED24_FMT path. The issue was addressed in the patch sequence starting with commit 7ef4c19d245f3dc...

CVE-2021-47370

CVE-2021-47370 affects the Linux kernel and concerns the MPTCP path: a signed/unsigned comparison in the code path that refills the TX cache can misbehave when size_goal is smaller than skb->len, causing the core TCP path to allocate an skb without the MPTCP extension. The fix rewrites the exp...

CVE-2021-47532

CVE-2021-47532 concerns a leak in the Linux kernel related to the DRM MSM devfreq OPP reference counter. The vulnerability is described as a local issue in the kernel’s OPP handling that could leak references in the OPP (Operating Performance Point) management path within the drm/msm/devfreq subs...