CVE-2026-52993

Summary (CVE-2026-52993): In the Linux kernel TIPC module, a double-free flaw occurs in tipc_buf_append() when tipc_msg_validate() reallocates an skb and the code incorrectly frees the original skb. The root cause is that the validation path may free a previously freed skb if reallocation occurs,...

CVE-2025-38561

CVE-2025-38561 concerns the ksmbd component of the Linux kernel. A race condition on Preauh_HashValue may occur when a client sends multiple session setup requests to ksmbd, due to how sess->Preauh_HashValue was previously freed during session setup. The fix moves freeing of sess->Preauh_Ha...

CVE-2025-38563

CVE-2025-38563 affects the Linux kernel perf subsystem. The issue arises when perf mmap-based mappings can be split (VMA split) after initial mapping, causing mismatched offsets/sizes and leaking reference counts for ringbuffer/auxiliary buffers. The fix adds vm_operations_struct.may_split() and ...

CVE-2025-38614

The CVE CVE-2025-38614 affects the Linux kernel eventpoll/epoll component. The vulnerability stemmed from semi-unbounded recursion in ep_loop_check_proc() and related upwards/downwards path checks, enabling depths up to ~500 in certain graphs before a fix. The fix introduces subtree depth trackin...

CVE-2025-39744

The CVE-2025-39744 issue affects the Linux kernel and describes a deadlock in rcu_read_unlock() when called during irq_exit() if an IPI is issued. The root cause is an incorrect handling of irq_work state inside rcu_read_unlock_special() triggered by irq_exit(), which can cause a system hang/lock...

CVE-2026-45942

Summary of CVE-2026-45942 : A race condition in the Linux kernel ext4 bitmap handling enables inconsistent bitmap reporting due to concurrent page migration and bitmap modification in the load_buddy path. The root cause is that the fast load_buddy path only increments the folio refcount and can o...

CVE-2026-46174

In CVE-2026-46174, the Linux kernel vulnerability affects x86/CPU/AMD Zen2 by allowing improper isolation of shared resources in the Zen2 op cache, potentially leading to instruction corruption. The issue has been resolved in the Linux kernel, with Debian and Root packaging advisories noting fixe...

CVE-2026-46324

CVE-2026-46324 concerns the Linux kernel’s nf_tables netlink hook handling. The vuln is fixed by replacing use of list_del_rcu() for nft_netdev_unregister_hooks and __nft_unregister_flowtable_net_hooks to prevent concurrent dumpers from walking the list while it’s modified. A new helper was added...

CVE-2026-52929

The CVE affects the Linux kernel SCTP stream handling. When ADD_OUT_STREAMS is denied, the rollback only shrinks queued chunks and lowers outcnt, leaving removed stream metadata behind. A subsequent re-add can reuse a stale ext and trigger a null-pointer dereference in the scheduler get path, pot...

CVE-2026-64355

CVE-2026-64355 (Linux kernel) shows a fix for a vulnerability in BPF devmap handling of fragmented frames. In native XDP, cloning fragmented frames could carry skb_shared_info in tailroom outside the linear area, leaving XDP_FLAGS_HAS_FRAGS set but with invalid frag metadata. The subsequent free ...

CVE-1999-0431

CVE-1999-0431 affects Linux kernels 2.2.3 and earlier, where a flaw in IP fragment handling lets a remote attacker perform an IP fragmentation attack to cause a denial of service. The Red Hat and CVE records consistently describe the issue as a remote DoS via IP fragmentation. Public details in t...

CVE-2004-0138

CVE-2004-0138 affects the Linux kernel 2.4 series prior to 2.4.25. The vulnerability lies in the ELF loader: a crafted ELF with an invalid interpreter arch triggers a BUG() when an invalid VMA is unmapped, allowing local denial of service (crash). The issue is mitigated by upgrading to 2.4.25 or ...

CVE-2004-1234

The CVE-2004-1234 entry refers to a vulnerability in the Linux kernel where load_elf_binary for ELF binaries with a NULL interpreter can trigger a denial of service (system crash) on local attackers. This affects Linux kernels prior to 2.4.26. The SUSE security page and related OpenVAS/DSA entrie...

CVE-2005-3105

CVE-2005-3105 affects the Linux kernel 2.6 on Itanium IA-64 Montecito (IA-64) where the mprotect code may lose cache coherency, enabling local users to cause a denial of service and possibly corrupt data by modifying PTE protections. Public advisories in connected documents (e.g., Debian DSA-922,...

CVE-2005-4798

CVE-2005-4798 is a buffer overflow in Linux kernel NFS readlink handling (affecting 2.4 up to 2.4.31). A remote NFS server could crash the NFS client. Debian advisories (DSA-1183-1, DSA-1184-1/2) document this vulnerability within kernel-source-2.4.27 and kernel-source-2.6.8, respectively, and de...

CVE-2008-2750

CVE-2008-2750 affects the Linux kernel (2.6.x) prior to 2.6.26-rc6. The vulnerability is in pppol2tp_recvmsg (drivers/net/pppol2tp.c) and can be triggered by a crafted PPPOL2TP packet that sets an abnormally large length value. Impact per the sources: remote attackers can cause a denial of servic...

CVE-2008-3792

CVE-2008-3792 affects the Linux kernel SCTP path: net/sctp/socket.c does not verify that the SCTP-AUTH extension is enabled before invoking SCTP-AUTH API functions. This can cause a denial of service (NULL pointer dereference/panic) via calls such as sctp_setsockopt_auth_chunk, sctp_setsockopt_hm...

CVE-2008-4302

CVE-2008-4302 affects the Linux kernel splice subsystem specifically fs/splice.c. The root cause is a failure in add_to_page_cache_lru, after which code attempts to unlock a page that was not locked, enabling a local user to trigger a kernel BUG and system crash (denial of service). Public adviso...

CVE-2010-1636

The CVE-2010-1636 issue affects the Linux kernel’s btrfs_ioctl_clone path (fs/btrfs/ioctl.c) where cloned file descriptors are not guaranteed to be opened for reading, allowing local users to read from a write-only descriptor. Affected: 2.6.29–2.6.32 (and possibly other versions). Impact: potenti...

CVE-2011-2518

The CVE-2011-2518 entry concerns the Linux kernel code path security/tomoyo/mount.c: tomoyo_mount_acl calls kern_path with arguments from the mount system call. This allows local users to trigger a denial of service (OOPS) or possibly other impact via a NULL device name in kernels before 2.6.39.2...

CVE-2011-2707

The CVE-2011-2707 entry affects the Linux kernel's arch/xtensa/kernel/ptrace.c, where the ptrace_setxregs() function does not validate user-space pointers. This allows a local user to read kernel memory via a crafted PTRACE_SETXTREGS request, as described for Linux kernel versions before 3.1. Pub...

CVE-2012-2127

CVE-2012-2127 affects the Linux kernel prior to 3.2, where fs/proc/root.c in procfs does not properly interact with CLONE_NEWPID clone system calls. This can enable a remote attacker to trigger a denial of service via a reference leak and growing memory usage by opening many connections to a PID-...

CVE-2012-5374

CVE-2012-5374: In the Linux kernel's Btrfs CRC32C hashing, pre-3.8-rc1 versions allow local users to trigger a denial of service by creating many files whose names map to the same CRC32C hash, extending kernel runtime. Verified by Nessus plugins describing a local DoS in Btrfs hashing within affe...

CVE-2014-4157

CVE-2014-4157 affects the Linux kernel on MIPS up to 3.14.8. The fast system-call path does not configure _TIF_SECCOMP checks, letting local attackers bypass PR_SET_SECCOMP restrictions by running a crafted app without trace/audit. Impact: partial confidentiality, integrity, and availability (loc...

CVE-2014-7207

CVE-2014-7207 affects the Linux kernel IPv6 implementation (3.2.x–3.2.63). The issue stems from improper validation in ipv6_select_ident function calls, permitting local users to trigger a NULL pointer dereference and system crash via tun or macvtap device access. Connected advisories confirm Deb...

CVE-2017-0524

CVE-2017-0524 concerns an elevation-of-privilege in the Synaptics touchscreen driver within Android kernels, allowing a local malicious application to execute arbitrary kernel code. According to the linked sources, affected components are the Synaptics touchscreen driver in Android products with ...

CVE-2021-47132

CVE-2021-47132 refers to a Linux kernel issue in the MPTCP code where sk_forward_memory could be corrupted during retransmission due to unsafe updates that did not acquire the msk spin lock. A fix was introduced that adds a new variant of the blamed function which explicitly acquires the msk spin...

CVE-2021-47164

CVE-2021-47164 is a Linux kernel vulnerability fixed by correcting a NULL dereference in net/mlx5e related to lag device handling. Explanation: in bond_enslave(), the active/backup slave was set before the upper dev is assigned; a second event with an upper dev can occur, and if lag dev is NULL a...

CVE-2021-47292

CVE-2021-47292 affects the Linux kernel io_uring subsystem. The issue is a memory leak in io_init_wq_offload() where a leaked hash_map can occur when io_uring_enter() is called in parallel (syz-executor traffic). Root cause: missing synchronization around kzalloc/hash_map updates in io_init_wq_of...

CVE-2021-47299

CVE-2021-47299 affects the Linux kernel XDP/BPF path: use-after-free in bpf_xdp_link_release between dev_get_by_index() and dev_xdp_attach_link(). Affected in-kernel code; patches are referenced (ca9ba1de8f09976b45ccc8e655c51c6201992139, a7537dc73e69ad9c0b67ad24ad3ebee954ed0af6, 5acc7d3e8d3428584...

CVE-2021-47607

CVE-2021-47607 is a Linux kernel issue where BPF_CMPXCHG could leak kernel addresses due to the verifier not rejecting unprivileged programs that place a pointer in R0. The high-level POC probes kernel addresses by using the map value pointer as R0 while SRC_REG has a canary, enabling address lea...

CVE-2022-48854

CVE-2022-48854 concerns a Linux kernel use-after-free in arc_emac's arc_mdio_probe. When bus->state == MDIOBUS_ALLOCATED, mdiobus_free(bus) frees the bus but bus->name is still used immediately after, leading to a use-after-free. The fix implements a local copy of the name and makes bus-&gt...

CVE-2022-48880

CVE-2022-48880 is a Linux kernel issue in platform/surface/aggregator where ssam_request_sync_init() can fail and the request may leak unless ssam_request_sync_free() is called. The fix adds the missing call to ssam_request_sync_free() to ensure proper freeing when initialization fails. This is a...

CVE-2022-48896

CVE-2022-48896 concerns a PCI device refcount leak in the Linux kernel’s ixgbe driver. The root cause, per the provided documents, is that pci_get_domain_bus_and_slot() returns a PCI device with an incremented refcount and callers must balance with pci_dev_put(). In affected paths (ixgbe_get_firs...

CVE-2022-48903

The CVE-2022-48903 entry refers to a Linux kernel vulnerability in the btrfs relocation path: a premature return from btrfs_commit_transaction can cause relocation-related crashes. The connected documents indicate upstream fixes in the kernel (e.g., commits addressing btrfs_relocate_block_group a...

CVE-2022-49150

CVE-2022-49150 in the Linux kernel relates to rtc: gamecube: Fix refcount leak in gamecube_rtc_read_offset_from_sram. The issue was that of_find_compatible_node() returned a node pointer with an incremented refcount and lacked a corresponding of_node_put() to release it. The connected documents c...

CVE-2022-49195

The CVE-2022-49195 entry documents a Linux kernel issue in the DSA driver: during multi-chip probing, all switches must probe, but up to N-1 may bind and later shutdown since the Nth switch initializes the tree. If that Nth initialization fails, shutdown on the other switches dereferences uniniti...

CVE-2022-49387

CVE-2022-49387 concerns the Linux kernel watchdog driver rzg2l_wdt. The root cause is a 32-bit overflow in timer_cycle_us that can yield 0, e.g., when a counter like 0xfff is used to compute maxval. The provided connected documents confirm a patch that promotes values to 64-bit by appending ULL t...

CVE-2022-49633

In the Linux kernel (CVE-2022-49633), a data-race was fixed in icmp_echo_enable_probe where readers could observe concurrent writes. The mitigation adds READ_ONCE() to readers to prevent reading torn data. The provided connected docs confirm this resolution and describe the underlying issue and f...

CVE-2022-49717

In CVE-2022-49717, the Linux kernel issue concerns irqchip/apple-aic: a refcount leak in build_fiq_affinity. The problem was that of_find_node_by_phandle() returns a node pointer with an incremented refcount, and the fix is to call of_node_put() when the node is no longer needed to avoid the leak...

CVE-2022-49844

The collection confirms CVE-2022-49844 affects the Linux kernel CAN subsystem. The issue arises from reading priv->ctrlmode in virtual CAN interfaces (e.g., vcan, vxcan) when some interfaces do not create struct can_priv at startup, causing an out-of-bounds read and CAN frame drops. The refere...

CVE-2022-49877

CVE-2022-49877 concerns a Linux kernel vulnerability resolved by a change in the BPF sockmap code. The issue manifests as a warning from sk_stream_kill_queues concerning sk_forward_alloc during test_sockmap selftests. The root cause was a mistaken use of msg->sg.size to replace the tosend valu...

CVE-2022-49959

The CVE-2022-49959 entry concerns a memory-leak in the Linux kernel related to openvswitch datapath creation. The root cause was that ovs_dp_cmd_new()->ovs_dp_change()->ovs_dp_set_upcall_portids() allocated an array with kmalloc but did not always free dp->upcall_portids when new_vport()...

CVE-2022-50001

The CVE-2022-50001 issue affects the Linux kernel netfilter component nft_tproxy. The root cause was that TPROXY could be used from non-prerouting paths, leading to a null dereference crash. The fix restricts nft_tproxy to the prerouting hook, requiring a check that it runs only in prerouting. Th...

CVE-2022-50038

CVE-2022-50038 affects the Linux kernel in drm/meson, specifically the meson_vpu_has_available_connectors() function. The issue consists of two refcount leak bugs: (1) missing of_node_put() for the 'ep' when exiting for_each_endpoint_of_node(), and (2) missing of_node_put() for the reference from...

CVE-2022-50080

CVE-2022-50080 (Linux kernel) affects kernel code path for tee/shm handling. The issue is an integer overflow in register_shm_helper() when calculating pages for a memory region supplied by user space, which can lead to a NULL pointer dereference in internal_get_user_pages_fast() via pin_user_pag...

CVE-2022-50104

CVE-2022-50104 affects the Linux kernel, specifically the powerpc/xive subsystem. The root cause is a refcount leak caused by a node pointer returned by of_find_node_by_path() with an incremented refcount and missing of_node_put() when done. The remediation is a patch that adds the missing of_nod...

CVE-2022-50171

CVE-2022-50171 affects the Linux kernel crypto path for Hisilicon sec2 (drivers/crypto/hisilicon/sec2/sec_crypto.c). The issue arises when the Kunpeng920 encryption driver processes packets during softirq: mutex locking is improperly used in softirq context, causing a scheduling-while-atomic scen...

CVE-2022-50184

The CVE-2022-50184 issue in the Linux kernel concerns a refcount leak in the Meson HDMI encoder path. Specifically, in drm/meson: encoder_hdmi_init, of_graph_get_remote_node() returns a remote device node pointer with an incremented refcount, and a missing of_node_put() could lead to a leak. The ...

CVE-2022-50203

CVE-2022-50203 affects the Linux kernel ARM OMAP2+ display path. The described issue is a refcount leak in omapdss_init_fbdev where of_find_node_by_name() can return a node with an incremented refcount. The recommended action is to call of_node_put() when the node is no longer used to prevent the...