CVE-2026-23069

CVE-2026-23069 (Linux kernel) : In vsock/virtio, the credit calculation in virtio_transport_get_credit() can underflow when the peer’s advertised buffer (peer_buf_alloc) shrinks while data is in flight, potentially allowing more data to be queued than the peer can handle. The issue arises from un...

CVE-1999-1225

Concretely, CVE-1999-1225 affects rpc.mountd and is described in SGI IRIX advisories as allowing a remote tester to probe for the existence of files by issuing mount requests, leading to distinguishable error messages. The SGI advisory fixes this by patching/upgrading IRIX (upgrade to IRIX 6.5.23...

CVE-2004-0075

The CVE-2004-0075 issue affects the Linux kernel's Vicam USB driver prior to 2.4.25. The vulnerability arises because data copied from userspace to kernel space does not use copy_from_user, crossing security boundaries and enabling a local attacker to cause a denial of service. Public advisories ...

CVE-2004-0887

CVE-2004-0887 affects SUSE Linux Enterprise Server 9 on the S/390 platform, where the SACF privileged instruction is not handled correctly, allowing a local user to gain root privileges. Connected sources also reference Debian advisories for kernel-source-2.4.27 updates (DSA-1018-1/2) that addres...

CVE-2004-2731

CVE-2004-2731 concerns the Linux kernel Sbus PROM driver (drivers/sbus/char/openprom.c) allowing local code execution via integer overflows when a small buffer is passed to copyin_string or a negative size to copyin. It affects 2.4.x (up to 2.4.27) and 2.6.x (up to 2.6.7) and possibly later versi...

CVE-2006-0557

CVE-2006-0557 : In the Linux kernel 2.6.x, the sys_mbind path in mempolicy.c failed to sanity-check the maxnod value before computing in get_nodes, enabling a local user to trigger a kernel crash (DoS). Public advisories tie this to local exploitation with kernel crashes, not remote code executio...

CVE-2006-1055

CVE-2006-1055: The Linux kernel

CVE-2009-2287

CVE-2009-2287 affects the Linux kernel’s KVM on x86, where KVM_SET_SREGS does not validate the page-table root (cr3). This can allow a local attacker to crash or hang the host (denial of service) via a crafted cr3 value, triggering a NULL pointer dereference in gfn_to_rmap. The issue is documente...

CVE-2011-0999

CVE-2011-0999 affects the Linux kernel (mm/huge_memory.c) up to 2.6.38-rc5. A local attacker could trigger creation of a transparent huge page (THP) during a temporary stack for an exec() call, enabling memory exhaustion and potential other impact. The issue is caused by not preventing THP creati...

CVE-2011-2209

The CVE-2011-2209 issue affects the Linux kernel on the Alpha architecture, where an integer signedness error in osf_sysinfo (arch/alpha/kernel/osf_sys.c) could allow local users to obtain sensitive information from kernel memory via a crafted call. Vulnerable when using kernel versions before 2....

CVE-2011-4604

CVE-2011-4604 affects the Linux kernel via batman-adv: the bat_socket_read function in net/batman-adv/icmp_socket.c allows remote memory corruption/DoS via crafted batman-adv ICMP packets. Affected: kernel versions prior to 3.3. Root cause: ICMP handling in batman-adv. Impact: memory corruption a...

CVE-2013-2546

CVE-2013-2546 concerns the Linux kernel 3.8.2 era: the crypto report API in the crypto user configuration API uses an incorrect string-copy function, enabling a local attacker with CAP_NET_ADMIN to leak information from kernel stack memory. The vulnerability is scoped to the report API in the ker...

CVE-2013-3228

The CVE-2013-3228 issue affects the Linux kernel’s irda_recvmsg_dgram (net/irda/af_irda.c), where a length variable is not initialized. This allows local attackers to read sensitive data from kernel stack via crafted recvmsg/recvfrom calls. Affected: Linux kernel versions before 3.9-rc7. Impact: ...

CVE-2013-7348

CVE-2013-7348 describes a double free vulnerability in the Linux kernel’s ioctx_alloc (fs/aio.c) prior to 3.12.4. An error path in aio_setup_ring can lead to a use-after-free like condition that enables a local attacker to trigger a system crash (DoS) or potentially other impact. The cited public...

CVE-2014-6418

Summary of CVE-2014-6418 — firmware/driver component: In Ceph usage within the Linux kernel, net/ceph/auth_x.c handles auth replies and, prior to kernel 3.16.3, fails to properly validate them. This can be triggered by crafted data arriving from a Ceph Monitor IP address, potentially causing a de...

CVE-2014-9888

CVE-2014-9888 affects the Linux kernel on ARM: memory allocated for DMA buffers could be mapped with executable permissions due to insufficient validation in arch/arm/mm/dma-mapping.c, before version 3.13. This is noted as affecting Android on Nexus devices (Nexus 5 and 7 2013) prior to 2016-08-0...

CVE-2015-4177

CVE-2015-4177 affects the Linux kernel, where the collect_mounts function in fs/namespace.c before 4.0.5 may run after a path has been unmounted. This can enable local users with user-namespace root access to trigger a denial of service (system crash) via an MNT_DETACH umount2 call. The vulnerabi...

CVE-2016-10907

Vulnerability CVE-2016-10907 affects the Linux kernel in drivers/iio/dac/ad5755.c up to version 4.8.5, with an out-of-bounds write in the function ad5755_parse_dt. Exploitation could lead to memory corruption. The ChangeLog indicates the issue was addressed in kernel 4.8.6 (and later). Controlled...

CVE-2016-8413

CVE-2016-8413 is an information disclosure vulnerability in the Qualcomm camera driver on Android. The issue affects Kernel-3.10 and Kernel-3.18 environments and could let a local malicious application access data outside its usual permission level after compromising a privileged process. Impact ...

CVE-2017-8063

The CVE-2017-8063 issue affects Linux kernel 4.9.x and 4.10.x before 4.10.12, where the cxusb.c driver in drivers/media/usb/dvb-usb mishandles interaction with CONFIG_VMAP_STACK, allowing a local user to cause a denial of service (system crash) or other unspecified impact by leveraging more than ...

CVE-2017-9211

The CVE-2017-9211 flaw affects the Linux kernel component crypto_skcipher_init_tfm in crypto/skcipher.c up to version 4.11.2. It relies on setkey without a key-size check, allowing a local user to cause a denial of service via a NULL pointer dereference. The connected documents indicate a patch/c...

CVE-2022-1976

CVE-2022-1976 affects the Linux kernel IO-URING implementation. The flaw allows a local attacker to craft a sequence of requests that triggers a use-after-free in the kernel, leading to memory corruption and possible privilege escalation. Across multiple sources, the issue is described without pu...

CVE-2022-48832

In CVE-2022-48832, the Linux kernel audit subsystem was fixed to prevent dereferencing the openat2 open_how.args in audit_match_perm(), which could cause an oops/page-fault. The root cause was unsafe access to syscall arguments when checking permissions, leading to potential instability. The reso...

CVE-2022-48873

CVE-2022-48873 affects the Linux kernel in the misc: fastrpc subsystem. The root cause is improper handling of map removal on error paths during creater_process and device_release, risking a use‑after‑free. The fixed behavior is to avoid removing the map from the list on error in fastrpc_init_cre...

CVE-2022-48880

CVE-2022-48880 is a Linux kernel issue in platform/surface/aggregator where ssam_request_sync_init() can fail and the request may leak unless ssam_request_sync_free() is called. The fix adds the missing call to ssam_request_sync_free() to ensure proper freeing when initialization fails. This is a...

CVE-2022-48896

CVE-2022-48896 concerns a PCI device refcount leak in the Linux kernel’s ixgbe driver. The root cause, per the provided documents, is that pci_get_domain_bus_and_slot() returns a PCI device with an incremented refcount and callers must balance with pci_dev_put(). In affected paths (ixgbe_get_firs...

CVE-2022-48898

CVE-2022-48898 concerns the Linux kernel drm/msm/dp path where the DP controller’s aux ISR could prematurely complete dp_aux_cmd_fifo_tx() even when the interrupt was not for an aux transfer, causing potential data corruption in EDID transfers during boot and in the host buffer. Multiple connecte...

CVE-2022-48924

CVE-2022-48924 relates to the Linux kernel, describing a memory-leak in the int340x thermal driver during int3400_notify() on Tiger Lake, leading to unreferenced objects and potential memory pressure. The provided documents consistently show the root cause as a leak in the int3400_notify path and...

CVE-2022-48984

The connected documents provide concrete details for CVE-2022-48984 affecting Linux kernel can: slcan: fix freed work crash. The issue manifests as a NULL pointer dereference in slcan when the LTP pty03 test crashes, with a crash trace in process_one_work and workqueue handling. Root cause: slcan...

CVE-2022-49403

The CVE-2022-49403 entry concerns the Linux kernel component lib/string_helpers. The vulnerability was resolved by adding an allocated strarray to a device’s resource list, ensuring automatic release when the device disappears. Root cause: strarray not being added to the device’s resource list, w...

CVE-2022-49633

In the Linux kernel (CVE-2022-49633), a data-race was fixed in icmp_echo_enable_probe where readers could observe concurrent writes. The mitigation adds READ_ONCE() to readers to prevent reading torn data. The provided connected docs confirm this resolution and describe the underlying issue and f...

CVE-2022-49692

The CVE-2022-49692 issue is a Linux kernel fix for the at803x PHY NULL pointer dereference on AR9331 PHY. The vulnerability manifested as kernel paging fault during PHY interrupt handling, traced to AR9331 switch/MDIO initialization and phylink/dsa probe paths. The remedy is in the latest kernel ...

CVE-2022-49757

CVE-2022-49757 – Linux kernel EDAC highbank memory leak fix . The vulnerability occurs in the highbank MC probe path where, if devres_open_group() fails, memory allocated by edac_mc_alloc() is not freed, causing a memory leak. The provided fixes call edac_mc_free() on the error handling path to p...

CVE-2022-49950

CVE-2022-49950 affects the Linux kernel: a bug in misc: fastrpc where the probe session-duplication overflow increments the session count even when no sessions are available, allowing memory corruption beyond the fixed-size slab-allocated fastrpc_session array during open(). This was fixed in the...

CVE-2022-50007

CVE-2022-50007: In the Linux kernel xfrm_policy_check(), on the error path when fetching pols[1] fails, pols[0] is not decremented, causing a refcount leak. The fix adds a decref for pols[0] in that path. Affected component: Linux kernel xfrm policy check. Impact described as memory leaks on erro...

CVE-2022-50059

CVE-2022-50059 is documented as a Linux kernel vulnerability affecting the Ceph integration: when handle_cap_grant is called on an IMPORT operation, the snap_rwsem is held and not reliably released, which could lead to a deadlock. The issue is described across multiple vendor advisories (EulerOS,...

CVE-2022-50121

CVE-2022-50121 affects the Linux kernel remoteproc code for k3-r5, where a missing of_node_put() in for_each_available_child_of_node() can leak a refcount when breaking early from the loop. The root cause is that each iteration decrements the previous node’s reference count without explicit relea...

CVE-2022-50123

CVE-2022-50123 affects the Linux kernel ASoC Mediatek mt8173 stack (mt8173_rt5650_rt5676_dev_probe). Root cause: of_parse_phandle() returns a node pointer with an incremented refcount and missing of_node_put() in error paths, leading to a potential refcount leak. The connected advisories document...

CVE-2022-50189

CVE-2022-50189 relates to a Linux kernel turbostat issue where a FILE pointer leak occurs if fscanf fails, causing an open file pointer to be leaked on an early return. The fix closes the file before returning (turbostat.c:2039) to remediate the resource leak. Affected component: Linux kernel tur...

CVE-2022-50204

CVE-2022-50204 concerns a Linux kernel issue affecting ARM OMAP2+ where pdata-quirks leaked a refcount in pdata_quirks_init_clocks due to a missing of_node_put() after using of_find_node_by_name() in a loop. The vulnerability is mitigated by a kernel fix that corrects the refcount handling, preve...

CVE-2022-50209

The CVE-2022-50209 issue in the Linux kernel concerns a refcount leak in meson_mx_socinfo_init. The root cause is that of_find_matching_node() can return a node pointer with an incremented refcount, requiring an of_node_put() when the reference is no longer needed. The fix adds the missing of_nod...

CVE-2022-50231

Root cause: in neon_poly1305_blocks, when both s[] and r[] are uninitialized, the code incorrectly uses the first 32-byte block to initialize s[] (first 16 bytes as key, next 16 as s[]), causing a read-out-of-bounds. The patch fixes this by ensuring the initialization uses poly1305_init_arm64() (...

CVE-2023-52978

Summary (CVE-2023-52978) : A Linux kernel issue affecting riscv kprobe probing of illegal positions could trigger a kernel panic with stack-protector corruption (example: probing in the middle of an instruction). The fix adds arch_check_kprobe in arch_prepare_kprobe to prevent illegal probe posit...

CVE-2023-52981

The CVE-2023-52981 issue affects the Linux kernel DRM/I915: the error-capture and debugfs dump paths had broken request reference counting when GuC submission was involved. The fixes adjust reference counting for the context-based search and the execlist-based search, ensuring proper get/put sema...

CVE-2024-39465

CVE-2024-39465 affects the Linux kernel's media: mgb4 path. A double removal of debugfs entries (debugfs_remove_recursive)—removing a parent directory and then its child—could trigger a kernel panic. The connected documents confirm a fix was applied in the Linux kernel to prevent this double-remo...

CVE-2024-40933

The CVE-2024-40933 entry concerns a Linux kernel IIO temperature driver mlx90635 issue. The vulnerability arises in mlx90635_probe() where a failure of devm_regmap_init_i2c() could yield regmap_ee as an error pointer rather than being checked with IS_ERR(regmap_ee), effectively a copy-paste error...

CVE-2024-40949

CVE-2024-40949 is a Linux kernel vulnerability affecting shmem folios in mm/memcontrol.c. The issue occurred when replacing an old shmem folio with a new one during swapin, causing mem_cgroup_migrate() to clear the old folio’s memcg data and preventing the old folio from obtaining the correct mem...

CVE-2024-40951

CVE-2024-40951 affects the Linux kernel (OCFS2 subsystem). The issue is a NULL pointer dereference in ocfs2_abort_trigger() caused by bdev->bd_super removal and an incorrect use of bh->b_assoc_map without proper initialization, leading to a crash when the function is invoked. The provided s...

CVE-2024-40985

CVE-2024-40985 concerns the Linux kernel TCP-AO subsystem. The issue is described as: in net/tcp_ao, ao_info could be leaked on error-path, introduced with TCP_AO_CMDF_AO_REQUIRED in patch set version 5. The vulnerability’s root cause is an information leak during error handling in the TCP-AO cod...

CVE-2024-40986

Summary (concrete details from connected documents): The Linux kernel DMA engine Xilinx XDMA driver (xdma.c) had a synchronization flaw in xdma_channel_isr() where the vchan lock was not acquired before using xdma->stop_request. Affected component: dmaengine: xilinx: xdma. Root cause: lack of ...