CVE-2007-1000

The CVE-2007-1000 issue affects the Linux kernel up to version 2.6.20.2, where the ipv6_getsockopt_sticky function in net/ipv6/ipv6_sockglue.c can trigger a NULL dereference through certain getsockopt calls, allowing local users to read arbitrary kernel memory. The vulnerability stems from a NULL...

CVE-2007-6733

CVE-2007-6733 affects the Linux kernel 2.6.9, where the nfs_lock function in fs/nfs/file.c fails to properly remove POSIX locks on files that are setgid without group-execute permission. This can allow local users to cause a denial of service (BUG and system crash) by locking a file on an NFS fil...

CVE-2008-2137

The CVE-2008-2137 entry describes a Linux kernel vulnerability in the SPARC/SPARC64 mmap checks. Affected are Linux kernel 2.4 before 2.4.36.5 and 2.6 before 2.6.25.3, where sparc_mmap_check (arch/sparc/kernel/sys_sparc.c) and sparc64_mmap_check (arch/sparc64/kernel/sys_sparc.c) omit some virtual...

CVE-2008-5701

CVE-2008-5701 is a Linux kernel local denial-of-service vulnerability on 64-bit MIPS platforms caused by an array index error in arch/mips/kernel/scall64-o32.S. It affects kernel versions prior to 2.6.28-rc8, where an o32 syscall with a small number can trigger an out-of-bounds access to the sysc...

CVE-2009-0935

CVE-2009-0935 affects Linux kernel inotify_read across 2.6.27–2.6.27.13, 2.6.28–2.6.28.2, and 2.6.29-rc3. The issue allows local users to trigger a denial of service (OOPS) by reading with an invalid address to an inotify instance, causing the event list mutex to be unlocked twice and preventing ...

CVE-2010-1187

The CVE-2010-1187 issue affects the Linux kernel TIPc (Transparent Inter-Process Communication) implementation, reported for kernel versions 2.6.16-rc1 through 2.6.33 (and potentially other versions). The vulnerability allows a local user to trigger a NULL pointer dereference and cause a kernel O...

CVE-2011-4080

CVE-2011-4080 affects the Linux kernel: sysrq_sysctl_handler in kernel/sysctl.c did not require CAP_SYS_ADMIN to modify dmesg_restrict, enabling local users (e.g., in LXC) to bypass restrictions and read the kernel ring buffer with root privileges. Public sources (Red Hat, SUSE, NVD) cite impact ...

CVE-2012-3364

CVE-2012-3364 relates to multiple stack-based buffer overflows in the Linux kernel’s Near Field Communication Controller Interface (NCI) before version 3.4.5. The flaw allows remote attackers to crash the system and potentially execute arbitrary code via incoming frames with crafted length fields...

CVE-2013-1958

CVE-2013-1958 affects Linux kernels before 3.8.6 where scm_check_creds in net/core/scm.c fails to enforce capabilities for the PID value tied to a UNIX domain socket, allowing local users to bypass access controls during a window when a user namespace exists but a PID namespace is not yet created...

CVE-2013-2548

The CVE-2013-2548 entry concerns the Linux kernel crypto user configuration API (the report API). Specifically, in crypto_report_one (crypto/crypto_user.c), an incorrect length value during a copy operation in the report path allows a local user with CAP_NET_ADMIN to leak kernel memory. The descr...

CVE-2013-3226

CVE-2013-3226 affects the Linux kernel Bluetooth SCO stack: sco_sock_recvmsg() in net/bluetooth/sco.c does not initialize a length variable, allowing local attackers to read kernel stack memory via crafted recvmsg/recvfrom calls. Affected releases are kernels prior to 3.9-rc7; the issue is addres...

CVE-2013-3227

CVE-2013-3227 affects the Linux kernel. The vulnerability is in the caif_seqpkt_recvmsg function (net/caif/caif_socket.c) where a length variable is not initialized. This can allow a local user to obtain sensitive information from kernel stack memory through a crafted recvmsg or recvfrom system c...

CVE-2013-4516

CVE-2013-4516 affects the Linux kernel: the mp_get_count function in drivers/staging/sb105x/sb_pci_mp.c before 3.12 does not initialize a data structure, enabling local users to read sensitive data from kernel stack memory via a TIOCGICOUNT ioctl. Reports reference the specific vulnerable code pa...

CVE-2014-9717

Vulnerability CVE-2014-9717 affects the Linux kernel prior to 4.0.2. The flaw is in fs/namespace.c where unmounting (MNT_DETACH) is processed by umount2 without ensuring MNT_LOCKED is unset, allowing local users to bypass access restrictions and access beneath a mount when running in a user names...

CVE-2016-8413

CVE-2016-8413 is an information disclosure vulnerability in the Qualcomm camera driver on Android. The issue affects Kernel-3.10 and Kernel-3.18 environments and could let a local malicious application access data outside its usual permission level after compromising a privileged process. Impact ...

CVE-2017-0523

CVE-2017-0523 is an elevation-of-privilege vulnerability in the Qualcomm Wi‑Fi driver that could allow a local malicious app to execute arbitrary code in the kernel. The CVSS3 vector indicates LOCAL access, high complexity, no privileges required, but user interaction is required; root cause is e...

CVE-2018-11232

The vulnerability CVE-2018-11232 affects the Linux kernel, specifically the etm_setup_aux function in drivers/hwtracing/coresight/coresight-etm-perf.c, and exists in versions prior to 4.10.2. The root cause is that a parameter is incorrectly used as a local variable, which can lead to a denial of...

CVE-2018-14656

Summary: CVE-2018-14656 describes a Linux kernel flaw where a missing address check in the callers of show_opcodes() can cause dumping of kernel memory into the dmesg log. The linked connected documents (Unity Linux advisories and OSV entries) confirm this kernel memory disclosure behavior. Affec...

CVE-2019-18810

CVE-2019-18810 affects the Linux kernel before 5.3.8, specifically a memory leak in komeda_wb_connector_add() within drivers/gpu/drm/arm/display/komeda/komeda_wb_connector.c. An attacker can trigger memory growth by causing drm_writeback_connector_init() failures, leading to denial of service via...

CVE-2021-47128

CVE-2021-47128 affects the Linux kernel’s SELinux lockdown integration (locked_down LSM hook). The vulnerability stems from buggy SELinux lockdown permission checks in the interaction between bpf/audit pathways and the lockdown checks, which can trigger problematic audit logging and deadlocks. Ex...

CVE-2021-47199

The CVE-2021-47199 issue in the Linux kernel's mlx5e CT offload layer causes a memleak of mod hdr actions due to CT clear action offload flow handling. Specifically, CT clear action offload adds the same set of mod hdr actions to reset ct_state when an encap action is present, potentially repeati...

CVE-2021-47266

CVE-2021-47266 affects the Linux kernel’s RDMA/IPOIB path. After a change that sets rtnl_link_ops for ipoib interfaces, moving an IPoIB device to a non-initial netns can cause the device to disappear when the owning netns is deleted, due to default_device_exit() skipping interfaces with rtnl_link...

CVE-2021-47282

CVE-2021-47282 relates to the Linux kernel bcm2835 SPI driver. The root cause is an out-of-bounds access triggered when more than 3 slaves are used: the code limited native chipselects to 3 via num_chipselect, while GPIO-based chipselects in the device tree could push the effective count higher, ...

CVE-2021-47313

The CVE-2021-47313 entry pertains to the Linux kernel cpufreq CPPC path, where a memleak could occur due to resources not being freed on policy->init() failure during cppc_cpufreq_cpu_init. The vulnerability, and its fix, are documented across multiple connected sources (kernel patch reference...

CVE-2021-47336

CVE-2021-47336 affects the Linux kernel via the smackfs path: the function smk_set_cipso() incorrectly handles a bytes-count restriction, due to a mistaken cross-check that applied only to the SMK_FIXED24_FMT path. The issue was addressed in the patch sequence starting with commit 7ef4c19d245f3dc...

CVE-2021-47532

CVE-2021-47532 concerns a leak in the Linux kernel related to the DRM MSM devfreq OPP reference counter. The vulnerability is described as a local issue in the kernel’s OPP handling that could leak references in the OPP (Operating Performance Point) management path within the drm/msm/devfreq subs...

CVE-2021-47601

CVE-2021-47601 in the Linux kernel fixes a NULL dereference caused by an IS_ERR() vs NULL check in the tee: amdtee path; __get_free_pages() returns NULL, not an error pointer. Affects Linux kernel; fix implemented in kernel updates (Unity Linux UTSA-2025-988866 and SUSE advisories SUSE-SU-2024:29...

CVE-2021-47617

CVE-2021-47617 affects the Linux kernel PCIe hot-plug controller (pciehp) in the PCIe Slot Common Service, specifically the Power Fault Detected (PFD) handling. The issue caused an infinite loop in the IRQ path due to the hardirq handler clearing the PFD bit before the power_fault_detected flag c...

CVE-2022-48660

CVE-2022-48660 is a Linux kernel vulnerability affecting gpiolib: cdev on certain platforms (ex: nxp-ls1028). The issue occurred when the IRQ for lineevent_state was set before the IRQ was successfully registered, leading to a warning trace from free_irq() during gpio tests and a resource release...

CVE-2022-48722

CVE-2022-48722 affects the Linux kernel, specifically the net/ieee802154: ca8210 path. On error, the helper ieee802154_xmit_complete() is not invoked and only ieee802154_wake_queue() is called, which can leak an skb. The remediation is to free the skb structure upon error before returning. Multip...

CVE-2022-48801

CVE-2022-48801 concerns the Linux kernel IIO subsystem, specifically the IIO_BUFFER_GET_FD_IOCTL path. The issue arises when copying the newly created file descriptor to userland fails; the cleanup attempts use put_unused_fd() for the descriptor that was already published by anon_inode_getfd() vi...

CVE-2022-48815

CVE-2022-48815 affects the Linux kernel bcm_sf2 DSA/MDIO path. The root cause is unsafe interaction between devres-managed mdiobus allocation/registration and manual mdiobus unregistering, where mdiobus_free() may panic if devm_mdiobus_free() triggers devres_release_all() before the bus is unregi...

CVE-2022-48837

The CVE-2022-48837 vulnerability affects the Linux kernel USB gadget RNDIS code: rndis_set_response() may overflow ifBufOffset is very large, because BufOffset + 8 can wrap. The documented impact is a potential overflow with high severity (CVE-2019-like pattern) and is described as impacting conf...

CVE-2022-48869

CVE-2022-48869 concerns the Linux kernel gadgetfs USB driver. The issue arises from a race between gadgetfs_fill_super() (mount path) and gadgetfs_kill_sb() (unmount path), where the_device could be deallocated while gadgetfs_fill_super() still uses it, resulting in a use-after-free. The provided...

CVE-2022-49978

In the Linux kernel, CVE-2022-49978 concerns the fbdev subsystem (fb_pm2fb) where, during do_fb_ioctl() handling of FBIOPUT_VSCREENINFO, a freely copied var may propagate to fb_set_var()/fb_check_var() and reach pm2fb_check_var(). If var->pixclock is zero, the reciprocal check can trigger a di...

CVE-2022-50049

CVE-2022-50049 affects the Linux kernel ASoC DPCM path: when adding BE connections, the code could pick a BE that does not support the required stream direction, risking a NULL dereference if a BE substream is missing. The patch adds a presence check for the target BE’s substream at dpcm_add_path...

CVE-2022-50067

Concretely, CVE-2022-50067 affects Linux kernel’s btrfs relocation logic: if prepare_to_relocate() triggers a failure during a transaction, the code frees the relocation control (rc) but does not clear fs_info->reloc_ctl, leading to a use-after-free when btrfs_init_reloc_root() later reads rc....

CVE-2022-50099

CVE-2022-50099 affects the Linux kernel video fbdev Arkfb component. In arkfb_set_par(), user input can set screen_size larger than info->screen_size, risking a kernel page fault (LOCAL, high impact). The mitigation described is to check screen_size before memset_io() and apply the provided pa...

CVE-2022-50118

CVE-2022-50118 describes a Linux kernel issue in the PowerPC perf PMU path. A new pmi_irq_pending check in hw_irq.h is used by power_pmu_disable to warn if PMI is pending when no counter overflows. The patch set removes the WARN_ON for PMI in this scenario and adds an optimization to clear pendin...

CVE-2022-50169

CVE-2022-50169 references a vulnerability in the Linux kernel’s wifi/wil6210 debugfs handling (wil_write_file_wmi). The root cause is that simple_write_to_buffer() succeeds if any single byte is initialized, which can leak information because the entire buffer may not be initialized. The fix init...

CVE-2022-50226

CVE-2022-50226 affects the Linux kernel crypto: ccp subsystem, where sev ioctl interfaces could allocate memory with kmalloc to handle input up to SEV_FW_BLOB_MAX_SIZE but were not fully overwritten by PSP firmware, risking uninitialized slab memory. The issue is resolved by changing ioctl memory...

CVE-2023-20841

CVE-2023-20841 affects imgsys and is described as an out-of-bounds write caused by missing valid range checking, enabling local escalation of privileges with System execution privileges needed. User interaction is required for exploitation. Reported patch ID: ALPS07326455 (Issue ID: ALPS07326441)...

CVE-2023-20843

CVE-2023-20843 involves an out-of-bounds read in the imgsys_cmdq component caused by missing valid range checking. Impact: local information disclosure with the potential for system-level execution privileges required, and exploitation reportedly needs user interaction. Affected context is MediaT...

CVE-2023-20850

The CVE concerns the imgsys_cmdq component in MediaTek chips, where an out-of-bounds write can occur due to missing valid range checking. This could permit local escalation of privilege with system execution privileges required, and user interaction is needed for exploitation. Documented impact i...

CVE-2023-2236

The CVE-2023-2236 entry describes a use-after-free in the Linux Kernel io_uring subsystem. The root cause is a reference underflow caused by fput being called in error paths within io_install_fixed_file and its callers, leading to a local privilege escalation. Affected software is the Linux kerne...

CVE-2023-52896

The CVE-2023-52896 issue affects the Linux kernel’s btrfs quota handling. A race between the quota rescan path and quota disable can lead the rescan worker to dereference a NULL quota_root, causing a NULL pointer dereference in btrfs_start_transaction. The root cause is that task B clears fs_info...

CVE-2024-40950

CVE-2024-40950 (Linux kernel) : The issue concerns mistaken use of mapping_large_folio_support for anonymous folios in THP handling, causing a mis-split of anon THP when splitting huge pages. Root cause: anon folios could be passed to mapping_large_folio_support() in split_huge_page_to_list_to_or...

CVE-2024-56740

CVE-2024-56740 affects the Linux kernel NFSv3 LOCALIO path. The issue arises when res.replen is not cleared in nfs_local_read_done, leading to memory corruption as data can be copied from stale hdrsize/replen values through nfs3_read_done -> server->read_hdrsize -> args.replen -> hdrs...

CVE-2024-57878

CVE-2024-57878 (Linux kernel, arm64) : The vulnerability in ptrace NT_ARM_FPMR regset handling could leave the temporary fpmr uninitialized for zero-length writes, potentially leaking up to 64 bits of kernel-stack memory. The patch initializes the temporary value before copying the regset from us...

CVE-2025-21803

CVE-2025-21803: In LoongArch, the Linux kernel fixed a warning during S3 suspend by removing a potential thread switch in enable_gpe_wakeup. Root cause was acpi_enable_all_wakeup_gpes() using a mutex, which could yield and leave the CPU interrupt-enabled state when enable_gpe_wakeup() returns. Th...