CVE-2023-52668

CVE-2023-52668 concerns the Linux kernel, specifically the btrfs zoned code path. The issue arises from incorrect lock ordering in btrfs_zone_activate(), where fs_info->zone_active_bgs_lock is taken after a block_group lock in some code paths, creating a potential circular locking dependency. ...

CVE-2023-52978

Summary (CVE-2023-52978) : A Linux kernel issue affecting riscv kprobe probing of illegal positions could trigger a kernel panic with stack-protector corruption (example: probing in the middle of an instruction). The fix adds arch_check_kprobe in arch_prepare_kprobe to prevent illegal probe posit...

CVE-2023-52986

CVE-2023-52986 is a Linux kernel issue affecting bpf, sockmap where a listening socket linked to a sockmap can have its sk_prot overridden to a variant in tcp_bpf_prots. The root cause is that cloning a child from a TCP listener checked only for the TCP_BPF_BASE proto variant, whereas the listene...

CVE-2023-53004

CVE-2023-53004 concerns a Linux kernel overlay (ovl) tmpfile leak due to a missed error cleanup. The vulnerability is resolved in the kernel with patches referenced by the stable commits listed in the sources. The CVSSv3.1 vector indicates LOCAL attack vector, LOW attack complexity and privileges...

CVE-2024-14027

CVE-2024-14027 in the Linux kernel: the fremovexattr() path leaks a file reference when strncpy_from_user() fails, due to missing fdput() after fdget(). This can allow an unprivileged local user to cause kernel memory exhaustion in multi-threaded contexts. The issue was inadvertently fixed by com...

CVE-2024-42100

Technical details for CVE-2024-42100 are not provided in the connected documents. The materials reference the CVE but do not specify affected products, versions, root cause, impact, or fixes beyond the initial description; monitor for updates.

CVE-2024-46799

In CVE-2024-46799, the Linux kernel driver net: ethernet: ti: am65-cpsw had a NULL pointer dereference when XDP_TX was used with TX queues configured to 1. The issue occurs during XDP_TX and manifests as a kernel NULL pointer dereference, as shown by the log entry. The publicly provided fix repla...

CVE-2024-57987

CVE-2024-57987 is a Linux kernel Bluetooth vulnerability in the btrtl driver. When inserting a USB dongle whose Realtek chip isn’t in ic_id_table, a NULL dereference could trigger a kernel oops. The fix adds a NULL check in btrtl_setup_realtek() to prevent the NULL pointer access. Affected: Linux...

CVE-2025-38440

CVE-2025-38440 affects the Linux kernel’s mlx5e DIM handling. A race between disabling DIM and in-flight NAPI callbacks that use the dim pointer on RQ/SQ could leave rq->dim/sq->dim NULL, causing a NULL pointer dereference in net_dim(). The remediation implemented is to call synchronize_net...

CVE-2025-38563

CVE-2025-38563 affects the Linux kernel perf subsystem. The issue arises when perf mmap-based mappings can be split (VMA split) after initial mapping, causing mismatched offsets/sizes and leaking reference counts for ringbuffer/auxiliary buffers. The fix adds vm_operations_struct.may_split() and ...

CVE-2025-38671

CVE-2025-38671 affects the Linux kernel i2c: qup driver. Root cause: timeout handling only set a return value and did not exit the loop when a client keeps the bus active, enabling kernel hang (observed with PCA953x GPIO extender). Fix: change the logic to return via -ETIMEDOUT, jumping out of th...

CVE-2025-38710

The CVE-2025-38710 vulnerability affects the Linux kernel GFS2: it relies on i_depth validation for exhash directories. A fuzzer introduced corruption that could yield a dir_e_read() depth of 0, causing an undefined shift by 32 at index = hash >> (32 - dip->i_depth). The minimum depth is...

CVE-2026-23154

CVE-2026-23154 concerns the Linux kernel fix for segmentation of forwarding fraglist GRO. The description explains that GRO packets containing a frag_list could be mishandled during GSO segmentation because skb_segment_list cannot correctly process GRO skbs converted by XLAT (which translates onl...

CVE-2026-23240

In CVE-2026-23240, the Linux kernel fixed a race condition in TLS handling where cancel_delayed_work_sync() used during tls_sk_proto_close() could allow tls_sw_cancel_work_tx() to schedule tx_work_handler() after the TLS object was freed. The root cause involved potential scheduling from paths li...

CVE-2026-43011

The CVE-2026-43011 issue concerns the Linux kernel net/x25 path where a skb may be freed twice due to a double-free path: if alloc_skb fails in x25_queue_rx_frame, kfree_skb(skb) is called, and later x25_backlog_rcv may free the same skb again, causing a crash/DoS. Public advisories confirm this ...

CVE-2026-43374

Summary: CVE-2026-43374 affects the Linux kernel networking code (net: nexthop). The vuln arises when removing a nexthop from a group: remove_nh_grp_entry() publishes the new group via rcu_assign_pointer() and then immediately frees the removed entry’s percpu stats with free_percpu(), while the s...

CVE-2026-46294

CVE-2026-46294 affects the Linux kernel device-mapper (dm-ioctl) in the retrieve_status path. A buffer-overflow could occur after aligning a pointer to an 8-byte boundary if the remaining length calculation wraps past the output buffer, potentially allowing writes beyond the buffer. The advisory ...

CVE-2026-52912

The CVE-2026-52912 affects the Linux kernel netfilter nf_queue handling of bridge LOCAL_IN traffic. br_pass_frame_up() rewrites skb->dev from the ingress port to the bridge master before queueing, allowing a queued bridge packet to retain a freed bridge master in skb->dev. On reinjection, b...

CVE-2026-53221

Linux kernel CVE-2026-53221 affects ip6_vti’s vti6_tnl_lookup() where, after an exact tunnel match fails, the fallback search for wildcard tunnels did not consistently verify that candidate tunnels actually have wildcard addresses. This mismatching happens because all tunnel types are stored in a...

CVE-2003-0619

The CVE-2003-0619 issue is an Integer signedness error in the decode_fh function of nfs3xdr.c in the Linux kernel prior to 2.4.21. Remote attackers could trigger a denial of service (kernel panic) by supplying a negative size value within XDR data of an NFSv3 procedure call. Public references not...

CVE-2003-0986

CVE-2003-0986 affects PPC64 on Linux kernels: 2.6 before 2.6.2 and 2.4 before 2.4.24. The issue arises when code copies data from userspace to kernelspace without using copy_from_user, failing to cross security boundaries and enabling local denial of service. Documents indicate a kernel fix/updat...

CVE-2004-1056

CVE-2004-1056 involves the Direct Rendering Manager (DRM) drivers in Linux kernel 2.6. It is caused by insufficient DMA lock checking, which could allow an authorized client to send arbitrary values to the video card, potentially causing an X server crash or modifying the video output. The vulner...

CVE-2004-1071

The CVE-2004-1071 issue affects the Linux kernel’s binfmt_elf loader (binfmt_elf.c) in kernels 2.4.x up to 2.4.27 and 2.6.x up to 2.6.8. A failed mmap is not handled correctly, leading to an incorrectly mapped image and potential local code execution by unauthorized users. The connected SUSE advi...

CVE-2005-2548

CVE-2005-2548 affects vlan_dev.c in the Linux kernel 2.6.8 VLAN code. It allows remote attackers to cause a kernel oops (denial of service) via certain UDP packets that trigger a function argument error; demonstrated with snmpwalk on snmpd. Public advisories from Debian, SUSE, Mandriva, Ubuntu, a...

CVE-2005-3108

CVE-2005-3108 affects the Linux kernel 2.6 on AMD64 (and a bug in the ioremap() path). Local users could trigger a denial of service or information leak by performing an ioremap on a memory map and causing iounmap to look up a non-existent page. Public advisories from Debian, Ubuntu, Red Hat/Cent...

CVE-2005-3257

Summary: CVE-2005-3257 affects the Linux kernel (examples: 2.6.12 and possibly 2.6.14.4) where a local user can exploit the KDSKBSENT ioctl on terminals of other users to escalate privileges, demonstrated by modifying key bindings via loadkeys. Affected components: vt_ioctl.c in the VT subsystem ...

CVE-2005-3806

CVE-2005-3806 affects Linux kernels 2.4 (up to 2.4.32) and 2.6 (before 2.6.14); IPv6 flow label handling in ip6_flowlabel.c may modify the wrong variable, enabling local attackers to corrupt kernel memory or trigger a crash by freeing non-allocated memory. Connected advisories (Debian DSA-1018-1/...

CVE-2007-1388

CVE-2007-1388 affects the Linux kernel IPv6 stack (do_ipv6_setsockopt in net/ipv6/ipv6_sockglue.c). A local user can trigger a NULL pointer dereference by calling setsockopt with IPV6_RTHDR (and possibly a zero/invalid option length), causing a kernel crash (DoS). The issue is addressed by kernel...

CVE-2007-2451

CVE-2007-2451 refers to a vulnerability in GEODE-AES (drivers/crypto/geode-aes.c) within the Linux kernel, fixed in kernel version 2.6.21.3. The issue is described as an unspecified vulnerability that could allow attackers to obtain sensitive information via unspecified vectors. The Linux kernel ...

CVE-2007-2764

The CVE-2007-2764 entry concerns the embedded Linux kernel in certain Sun-Brocade SilkWorm switches prior to 20070516. The issue arises when a non-root user creates a kernel process, which can lead to a denial of service (kernel oops) and device reboot via unspecified vectors. The NVD entry assig...

CVE-2008-6107

The CVE-2008-6107 entry maps to a Linux kernel vulnerability affecting Sparc/Sparc64 paths before kernel 2.6.25.4. Specifically, the sys32_mremap function (arch/sparc64/kernel/sys_sparc32.c) and the mmap-check routines (sparc_mmap_check in arch/sparc/kernel/sys_sparc.c and sparc64_mmap_check in a...

CVE-2009-0935

CVE-2009-0935 affects Linux kernel inotify_read across 2.6.27–2.6.27.13, 2.6.28–2.6.28.2, and 2.6.29-rc3. The issue allows local users to trigger a denial of service (OOPS) by reading with an invalid address to an inotify instance, causing the event list mutex to be unlocked twice and preventing ...

CVE-2009-1184

CVE-2009-1184 affects the Linux kernel’s SELinux subsystem: the function security/selinux/hooks.c (selinux_ip_postroute_iptables_compat) omits avc_has_perm checks for the node and port when compat_net is enabled, allowing local users to bypass certain network-traffic restrictions. Impact is parti...

CVE-2010-1643

CVE-2010-1643 affects the Linux kernel mm/shmem.c: when strict overcommit is enabled, export of shmemfs objects by knfsd is mishandled, allowing a denial of service via NULL pointer dereference and knfsd crash. The issue is fixed in the 2.6.28‑rc3 update (and later); affected users should upgrade...

CVE-2011-1023

CVE-2011-1023 affects the Linux kernel RDS (Reliable Datagram Sockets) subsystem prior to 2.6.38. The issue arises in congestion map updates, allowing a local, unprivileged user to trigger a denial of service (BUG_ON and system crash) via loopback (loop) or InfiniBand (ib) transmit vectors. The v...

CVE-2011-4611

The CVE-2011-4611 entry relates to the Linux kernel on POWERPC where an integer overflow in perf_event_interrupt (arch/powerpc/kernel/perf_event.c) before version 2.6.39 can allow a local user to trigger a denial of service via performance-event handling. Affected: Linux kernel releases prior to ...

CVE-2017-5550

CVE-2017-5550 describes an off-by-one/error in the Linux kernel pipe_advance function (lib/iov_iter.c) that could allow local attackers to read from uninitialized kernel heap memory via a pipe, before the fixed 4.9.5 release. Connected advisories (EulerOS, Unity Linux) reference kernel versions b...

CVE-2018-10074

CVE-2018-10074 affects the Linux kernel hi3660: hi3660_stub_clk_probe in drivers/clk/hisilicon/clk-hi3660-stub.c (kernel

CVE-2018-14656

Summary: CVE-2018-14656 describes a Linux kernel flaw where a missing address check in the callers of show_opcodes() can cause dumping of kernel memory into the dmesg log. The linked connected documents (Unity Linux advisories and OSV entries) confirm this kernel memory disclosure behavior. Affec...

CVE-2021-47266

CVE-2021-47266 affects the Linux kernel’s RDMA/IPOIB path. After a change that sets rtnl_link_ops for ipoib interfaces, moving an IPoIB device to a non-initial netns can cause the device to disappear when the owning netns is deleted, due to default_device_exit() skipping interfaces with rtnl_link...

CVE-2021-47282

CVE-2021-47282 relates to the Linux kernel bcm2835 SPI driver. The root cause is an out-of-bounds access triggered when more than 3 slaves are used: the code limited native chipselects to 3 via num_chipselect, while GPIO-based chipselects in the device tree could push the effective count higher, ...

CVE-2021-47561

CVE-2021-47561 affects the Linux kernel i2c virtio driver. The issue arises when a timeout occurs: the device can continue operating on buffers the guest has freed, risking data corruption on the I2C bus and potential memory corruption inside the guest. The root cause is improper timeout handling...

CVE-2021-47607

CVE-2021-47607 is a Linux kernel issue where BPF_CMPXCHG could leak kernel addresses due to the verifier not rejecting unprivileged programs that place a pointer in R0. The high-level POC probes kernel addresses by using the map value pointer as R0 while SRC_REG has a canary, enabling address lea...

CVE-2022-48640

The CVE-2022-48640 entry documents a NULL dereference in the Linux kernel bonding subsystem. Root cause: when a bond is created with an initial mode other than Round Robin (mode != 0), the memory for the bonding.rr_tx_counter is not allocated, so switching modes later does not verify allocation, ...

CVE-2022-48660

CVE-2022-48660 is a Linux kernel vulnerability affecting gpiolib: cdev on certain platforms (ex: nxp-ls1028). The issue occurred when the IRQ for lineevent_state was set before the IRQ was successfully registered, leading to a warning trace from free_irq() during gpio tests and a resource release...

CVE-2022-48663

CVE-2022-48663 affects the Linux kernel, specifically the GPIO mockup debugfs handling. The vulnerability arises when unbinding a driver: debugfs entries are removed globally before platform devices are unregistered, which can lead to a NULL pointer dereference on module exit. The disclosed fix u...

CVE-2022-48880

CVE-2022-48880 is a Linux kernel issue in platform/surface/aggregator where ssam_request_sync_init() can fail and the request may leak unless ssam_request_sync_free() is called. The fix adds the missing call to ssam_request_sync_free() to ensure proper freeing when initialization fails. This is a...

CVE-2022-49195

The CVE-2022-49195 entry documents a Linux kernel issue in the DSA driver: during multi-chip probing, all switches must probe, but up to N-1 may bind and later shutdown since the Nth switch initializes the tree. If that Nth initialization fails, shutdown on the other switches dereferences uniniti...

CVE-2022-49245

CVE-2022-49245 affects the Linux kernel ASoC Rockchip implementation, specifically the rockchip_i2s_tdm_resume path. The root cause is that pm_runtime_get_sync would increment the PM usage counter even when the operation failed, leading to a reference counter leak. The documented fix replaces the...

CVE-2022-49360

CVE-2022-49360 (Linux kernel, f2fs): The issue arises from a root-cause mismatch where ckpt.valid_block_count is inconsistent with the SIT table, causing a panic during garbage collection when the LFS allocator cannot find a free segment despite the filesystem reporting free blocks. The reference...