CVE-2025-38516

CVE-2025-38516 is a Linux kernel vulnerability in the pinctrl/qcom/msm subsystem. The issue arises when certain pins are registered as IRQ-capable on platforms where intr_detection_width is not 1 or 2, enabling a user-space trigger that can cause a BUG() in msm_gpio_irq_set_type() and potentially...

CVE-2025-38528

CVE-2025-38528: Linux kernel BPF format-string vulnerability in bprintf-like helpers. Root cause: bpf_bprintf_prepare incorrectly skips the second % in %p% during processing, allowing a risky %\x00 to reach the format decoder. The patch changes behavior to not skip punctuation, causing the invali...

CVE-2025-39702

CVE-2025-39702 is a Linux kernel issue where ipv6: sr: Fix MAC comparison to be constant-time addresses timing-attack risk. Connected documents confirm kernels across multiple distributions (e.g., kernel6.12 line for Amazon Linux ALAS, Debian LTS DLA, Astralinux, Mariner/CBL) are affected in vers...

CVE-2026-23410

CVE-2026-23410 – Linux kernel (AppArmor) race condition has a documented use-after-free in rawdata handling. The issue occurs when rawdata inodes aren’t refcounted, allowing an attacker to open a rawdata file while the last reference is removed (e.g., via profile removal), freeing the aa_loaddata...

CVE-2026-31613

The CVE-2026-31613 issue affects the Linux kernel SMB client. A crafted symlink error response from a remote SMB server can trigger an out-of-bounds read during symlink parsing, allowing UTF-16 data to be read via readlink(2). Root cause: smb2_check_message() accepts a CREATE status without valid...

CVE-2026-31649

The CVE-2026-31649 issue affects the Linux kernel’s stmmac driver, where jumbo_frm() can underflow when processing fragmented packets. If nopaged_len is small but skb->len is large, len = nopaged_len - buf_len (with buf_len clamped to min(nopaged_len, bmax)) can still yield a large unsigned va...

CVE-2026-45852

Summary of CVE-2026-45852 (Linux kernel RDMA/rxe): A double-free vulnerability exists in the rxe_srq_from_init path of the RDMA subsystem. The queue pointer is temporarily assigned to srq->rq.queue before copy_to_user(), so if copy_to_user() fails, cleanup frees the same memory twice when the ...

CVE-2026-53212

The CVE-2026-53212 issue affects the Linux kernel nft_tunnel implementation within netfilter, where nft_tunnel_obj_destroy() used metadata_dst_free() to free a metadata_dst, bypassing dst_entry refcount accounting. This could leave in-flight packets that hold references (via dst_hold()) dangling,...

CVE-2003-0018

CVE-2003-0018 concerns Linux kernel 2.4.10–2.4.21-pre4 where O_DIRECT is mishandled, allowing local attackers with write privileges to read portions of previously deleted files or cause filesystem corruption. Related advisories (SUSE CVE-2003-0956; Debian DSA-358/423) note multiple O_DIRECT-relat...

CVE-2003-0986

CVE-2003-0986 affects PPC64 on Linux kernels: 2.6 before 2.6.2 and 2.4 before 2.4.24. The issue arises when code copies data from userspace to kernelspace without using copy_from_user, failing to cross security boundaries and enabling local denial of service. Documents indicate a kernel fix/updat...

CVE-2005-0135

Technical details for CVE-2005-0135 are not publicly provided in the connected documents. The sources reference kernel updates and include CVE lists, but do not specify affected products/versions, root cause, impact, or remediation. Monitor for updates.

CVE-2005-0136

Technical details for CVE-2005-0136 are not publicly available in the provided documents. Please monitor for updates in the connected feeds for affected products, components, and remediation information; no concrete exploit vectors, affected versions, or fixes are specified here.

CVE-2005-1041

The CVE-2005-1041 issue affects the Linux kernel and is caused by the fib_seq_start() function in fib_hash.c, allowing a local attacker to crash the system via /proc/net/route (Denial of Service). Public advisories confirm affected distributions and provide fixes: Ubuntu USN-131-1 upgrades to ker...

CVE-2005-2553

CVE-2005-2553 affects Linux kernel 2.4.x before 2.4.29, where a NULL pointer dereference in ptrace32.c's find_target can crash the kernel when tracing a 64-bit executable with 32-bit ltrace. The vulnerability is local and may lead to a kernel oops/crash. Public advisories in connected docs (e.g.,...

CVE-2005-2709

The CVE-2005-2709 issue affects the Linux kernel's sysctl.c in kernels prior to 2.6.14.1. Local users could exploit a window created by opening an interface file under /proc/sys/net/ipv4/conf/, wait for the interface to unregister, then read/modify function pointers in memory used for the ctl_tab...

CVE-2006-0558

CVE-2006-0558 affects the Linux kernel perfmon subsystem on IA-64. The vulnerability enables local users to trigger a denial of service (crash) by interrupting a task while another process is accessing the mm_struct, causing a BUG_ON in put_page_testzero. Public context across connected documents...

CVE-2006-1525

CVE-2006-1525 affects the Linux kernel 2.6 series (before 2.6.16.8). The vulnerability arises in ip_route_input, where a local user can trigger a NULL pointer dereference by requesting a route for a multicast IP address, leading to a denial of service (panic). Public references in Debian/DSA advi...

CVE-2006-4623

The vulnerability CVE-2006-4623 affects the Linux kernel DVB ULE decapsulation path: Unidirectional Lightweight Encapsulation (ULE) in dvb-core/dvb_net.c of the kernel 2.6.17.8. A remote attacker can cause a denial of service (crash) by sending a ULE packet with an SNDU length of 0. Public adviso...

CVE-2007-2451

CVE-2007-2451 refers to a vulnerability in GEODE-AES (drivers/crypto/geode-aes.c) within the Linux kernel, fixed in kernel version 2.6.21.3. The issue is described as an unspecified vulnerability that could allow attackers to obtain sensitive information via unspecified vectors. The Linux kernel ...

CVE-2008-3534

CVE-2008-3534 affects the Linux kernel tmpfs implementation (shmem.c: shmem_delete_inode). A local attacker could crash the system by a specific sequence of file create/remove/overwrite operations, linked to allocation of “useless pages” and improper maintenance of i_blocks. Public advisories con...

CVE-2008-4113

The vulnerability CVE-2008-4113 affects the Linux kernel prior to 2.6.26.4 with SCTP-AUTH enabled. In sctp_getsockopt_hmac_ident (net/sctp/socket.c), an untrusted length value is used to bound data copied from kernel memory, allowing a local unprivileged user to disclose sensitive kernel memory c...

CVE-2008-6107

The CVE-2008-6107 entry maps to a Linux kernel vulnerability affecting Sparc/Sparc64 paths before kernel 2.6.25.4. Specifically, the sys32_mremap function (arch/sparc64/kernel/sys_sparc32.c) and the mmap-check routines (sparc_mmap_check in arch/sparc/kernel/sys_sparc.c and sparc64_mmap_check in a...

CVE-2009-1388

CVE-2009-1388 affects the Linux kernel 2.6.18, where the ptrace_start function does not properly handle simultaneous execution with do_coredump, enabling local users to trigger a deadlock (DoS) via ptrace and a coredumping thread. The connected MiracleLinux doc explicitly lists CVE-2009-1388 amon...

CVE-2010-1162

CVE-2010-1162 affects the Linux kernel before 2.6.34-rc4, in which release_one_tty() in drivers/char/tty_io.c omits certain required put_pid() calls. The impact is described as unspecified, with local attack vectors. The available connected documents confirm the vulnerability and reference the af...

CVE-2010-2538

CVE-2010-2538: Integer overflow in btrfs_ioctl_clone (fs/btrfs/ioctl.c) of the Linux kernel before 2.6.35 may allow local users to obtain sensitive information via BTRFS_IOC_CLONE_RANGE. Public references confirm impact on local privilege/user data exposure with no remote vector. Affected compone...

CVE-2010-4256

CVE-2010-4256 affects the Linux kernel: the pipe_fcntl code in fs/pipe.c before 2.6.37 may misidentify named pipes, enabling a local user to cause a denial of service via an F_SETPIPE_SZ fcntl call. The issue is tracked across multiple advisories (e.g., Ubuntu USN-1083-1, RH advisories) and was f...

CVE-2011-2184

The CVE-2011-2184 entry concerns Linux kernel prior to 2.6.39.1 where key_replace_session_keyring fails to initialize a structure member, enabling local users to trigger a NULL pointer dereference and system crash via KEYCTL_SESSION_TO_PARENT in keyctl. This is a distinct issue from CVE-2010-2960...

CVE-2011-2521

Linux kernel Performance Events vulnerability CVE-2011-2521: the x86_assign_hw_event path in arch/x86/kernel/cpu/perf_event.c miscalculates counter values, allowing a local user to trigger a denial of service (kernel panic) via the perf tool. Affected: Linux kernel before 2.6.39. Root cause: inco...

CVE-2011-4325

CVE-2011-4325 – Linux kernel NFS vulnerability : The NFS implementation in the Linux kernel up to 2.6.31-rc6 can dereference uninitialized data, enabling a local denial-of-service via NULL pointer dereference and an O_DIRECT oops (e.g., demonstrated with diotest4 from LTP). Affected component: ke...

CVE-2011-4611

The CVE-2011-4611 entry relates to the Linux kernel on POWERPC where an integer overflow in perf_event_interrupt (arch/powerpc/kernel/perf_event.c) before version 2.6.39 can allow a local user to trigger a denial of service via performance-event handling. Affected: Linux kernel releases prior to ...

CVE-2013-2896

The CVE-2013-2896 issue affects the Linux kernel HID driver: drivers/hid/hid-ntrig.c, applicable when CONFIG_HID_NTRIG is enabled, up to kernel version 3.11. It allows physically proximate attackers to trigger a denial of service (NULL pointer dereference and OOPS) via a crafted HID device. Explo...

CVE-2013-3226

CVE-2013-3226 affects the Linux kernel Bluetooth SCO stack: sco_sock_recvmsg() in net/bluetooth/sco.c does not initialize a length variable, allowing local attackers to read kernel stack memory via crafted recvmsg/recvfrom calls. Affected releases are kernels prior to 3.9-rc7; the issue is addres...

CVE-2013-4300

CVE-2013-4300 affects the Linux kernel (pre-3.11). The vulnerability arises from a faulty capability check in scm_check_creds() in net/core/scm.c that uses an incorrect namespace, enabling local users to gain privileges via PID spoofing. Impact: local privilege escalation with complete confidenti...

CVE-2013-5634

CVE-2013-5634 affects the Linux kernel on ARM when KVM is used: arch/arm/kvm/arm.c allows a host OS user to trigger a denial of service (NULL pointer dereference, OOPS, host crash) by omitting vCPU initialization before a KVM_GET_REG_LIST ioctl. The issue is fixed by upgrading to a kernel version...

CVE-2016-6516

The CVE-2016-6516 issue is a race condition in the Linux kernel’s ioctl_file_dedupe_range implementation (fs/ioctl.c) present in kernels up to 4.7. It can allow local users to cause a denial of service via a heap-based buffer overflow, or potentially gain privileges by altering a count value (a d...

CVE-2019-18807

Two memory leaks in the Linux kernel sja1105_static_config_upload() (drivers/net/dsa/sja1105/sja1105_spi.c) before 5.3.5 can cause memory‑based DoS. The leaks arise when static_config_buf_prepare_for_upload() or sja1105_inhibit_tx() fail (CID‑68501df92d11). Affected product is the Linux kernel; v...

CVE-2021-47195

CVE-2021-47195 relates to the Linux kernel SPI subsystem. The issue is a use-after-free caused by unlocking a per-controller mutex (add_lock) after the controller has already been freed during spi_unregister_controller(ctlr) and subsequent put_device flow. The fix moves put_device() after the mut...

CVE-2021-47268

CVE-2021-47268: Unity/Linux kernel advisory describes a fix for usb: typec: tcpm: cancel vdm and state machine hrtimer when unregister tcpm port, addressing a pending hrtimer that may expire after tcpm port destruction. Root cause is a pending hrtimer in tcpm that could fire during module unload,...

CVE-2021-47286

CVE-2021-47286 affects the Linux kernel MHI bus core. The issue arises when processing command completions: the channel ID read from the device event ring can be any value 0–255, risking out-of-bounds accesses. The fix adds a bounds check against the controller’s maximum channels and against chan...

CVE-2021-47317

CVE-2021-47317 concerns the Linux kernel’s powerpc/bpf component. A commit changed BPF_XADD to BPF_ATOMIC and introduced a mechanism to distinguish instructions by the immediate field. JITs were updated to enforce that only certain immediates (e.g., BPF_ADD) are allowed, but the powerpc64 JIT che...

CVE-2021-47318

CVE-2021-47318 concerns the Linux kernel’s topology management. The vulnerability arises in arch_topology where topology_scale_freq_tick() may dereference a pointer to a previously cleared scale_freq_data , due to missing protection before the data is freed. The issue is localized to the kernel’s...

CVE-2021-47605

CVE-2021-47605: In the Linux kernel vduse component, memory writes can occur due to an out-of-bounds config.offset when handling vduse_dev_ioctl(); dev->config_size and config.offset are 32-bit, enabling memory corruption. The Nessus entry (UNPATCHED_CVE_2021_47605.NASL) confirms the issue and...

CVE-2021-47608

CVE-2021-47608 involves a bug in the Linux kernel BPF fetch path (bpf: Fix kernel address leakage in atomic fetch) where a faulty check_mem_access() handling could cause leakage of kernel pointers from spilled stack registers when performing atomic XADD. The issue arises in the BPF_FETCH path, wh...

CVE-2022-3541

CVE-2022-3541 affects the Linux kernel Sunplus Ethernet driver (spl2sw_nvmem_get_mac_address in drivers/net/ethernet/sunplus/spl2sw_driver.c). The issue is a use-after-free vulnerability, as described in the initial document. Connected sources (Ubuntu USN advisories and Nessus/OpenVAS entries) co...

CVE-2022-48660

CVE-2022-48660 is a Linux kernel vulnerability affecting gpiolib: cdev on certain platforms (ex: nxp-ls1028). The issue occurred when the IRQ for lineevent_state was set before the IRQ was successfully registered, leading to a warning trace from free_irq() during gpio tests and a resource release...

CVE-2022-48663

CVE-2022-48663 affects the Linux kernel, specifically the GPIO mockup debugfs handling. The vulnerability arises when unbinding a driver: debugfs entries are removed globally before platform devices are unregistered, which can lead to a NULL pointer dereference on module exit. The disclosed fix u...

CVE-2022-48762

CVE-2022-48762 affects the Linux kernel on arm64, where the extable path load_unaligned_zeropad() incorrectly derives register indices from ex->type instead of ex->data in ex_handler_load_unaligned_zeropad(). This misinterpretation (treating X0 as the address register and X4 as the data reg...

CVE-2022-48795

CVE-2022-48795 maps to a PA-RISC Linux kernel issue: overrunning sglist in sba_unmap_sg caused a Data TLB miss and null-pointer dereference, leading to a kernel panic. The root cause was testing sg_dma_len(sglist) before confirming remaining entries (nents), which could cross a page boundary and ...

CVE-2022-48832

In CVE-2022-48832, the Linux kernel audit subsystem was fixed to prevent dereferencing the openat2 open_how.args in audit_match_perm(), which could cause an oops/page-fault. The root cause was unsafe access to syscall arguments when checking permissions, leading to potential instability. The reso...

CVE-2022-48898

CVE-2022-48898 concerns the Linux kernel drm/msm/dp path where the DP controller’s aux ISR could prematurely complete dp_aux_cmd_fifo_tx() even when the interrupt was not for an aux transfer, causing potential data corruption in EDID transfers during boot and in the host buffer. Multiple connecte...