CVE-1999-0431

CVE-1999-0431 affects Linux kernels 2.2.3 and earlier, where a flaw in IP fragment handling lets a remote attacker perform an IP fragmentation attack to cause a denial of service. The Red Hat and CVE records consistently describe the issue as a remote DoS via IP fragmentation. Public details in t...

CVE-2004-0010

This CVE describes a stack-based buffer overflow in the ncp_lookup function of ncpfs in Linux kernel 2.4.x, enabling local privilege escalation. The provided documents do not specify affected kernel versions beyond 2.4.x, nor remediation or exploit status. No connected documents add concrete tech...

CVE-2005-1041

The CVE-2005-1041 issue affects the Linux kernel and is caused by the fib_seq_start() function in fib_hash.c, allowing a local attacker to crash the system via /proc/net/route (Denial of Service). Public advisories confirm affected distributions and provide fixes: Ubuntu USN-131-1 upgrades to ker...

CVE-2005-2553

CVE-2005-2553 affects Linux kernel 2.4.x before 2.4.29, where a NULL pointer dereference in ptrace32.c's find_target can crash the kernel when tracing a 64-bit executable with 32-bit ltrace. The vulnerability is local and may lead to a kernel oops/crash. Public advisories in connected docs (e.g.,...

CVE-2005-2973

CVE-2005-2973 : Linux kernel vn UDPv6 port handling flaw in udp_v6_get_port (in Linux 2.6 before 2.6.14-rc5) allows a local user, when IPv6 is enabled, to trigger an infinite loop and kernel crash (local DoS). Ubuntu advisory USN-219-1 references this CVE and notes kernel updates as remediation. ...

CVE-2005-3274

CVE-2005-3274 is a race condition in the Linux kernel’s SMP path for ip_vs_conn_flush, where a connection timer can expire while the connection table is being flushed before the correct lock is held. Affects Linux 2.6.x (before 2.6.13) and 2.4.x (before 2.4.32-pre2). Local users could trigger a n...

CVE-2006-0558

CVE-2006-0558 affects the Linux kernel perfmon subsystem on IA-64. The vulnerability enables local users to trigger a denial of service (crash) by interrupting a task while another process is accessing the mm_struct, causing a BUG_ON in put_page_testzero. Public context across connected documents...

CVE-2006-1055

CVE-2006-1055: The Linux kernel

CVE-2006-4623

The vulnerability CVE-2006-4623 affects the Linux kernel DVB ULE decapsulation path: Unidirectional Lightweight Encapsulation (ULE) in dvb-core/dvb_net.c of the kernel 2.6.17.8. A remote attacker can cause a denial of service (crash) by sending a ULE packet with an SNDU length of 0. Public adviso...

CVE-2006-5701

CVE-2006-5701 is a real issue in the Linux kernel 2.6.x squashfs module where mounting a crafted squashfs filesystem can cause a local denial of service due to a double-free condition. Affected by this vulnerability are systems using the squashfs implementation in 2.6.x kernels (as referenced by ...

CVE-2006-5871

CVE-2006-5871 affects the Linux kernel (notably 2.6.8 and 2.4.x prior to 2.4.34) where UNIX extensions are enabled. The vulnerability arises because smbfs ignores certain mount options, allowing a client to end up using server-specified uid, gid, and mode settings. Connected records (e.g., Debian...

CVE-2006-6056

CVE-2006-6056 affects Linux kernel 2.6.x up to 2.6.18 with SELinux hooks enabled. It causes a local denial of service (crash) via a malformed file stream that triggers a NULL pointer dereference in superblock_doinit when using an HFS filesystem image. Connected advisories (e.g., RHSA/CESA) indica...

CVE-2007-1000

The CVE-2007-1000 issue affects the Linux kernel up to version 2.6.20.2, where the ipv6_getsockopt_sticky function in net/ipv6/ipv6_sockglue.c can trigger a NULL dereference through certain getsockopt calls, allowing local users to read arbitrary kernel memory. The vulnerability stems from a NULL...

CVE-2007-1353

CVE-2007-1353 affects the Linux kernel’s Bluetooth stack (L2CAP and HCI) and can allow a context-dependent attacker to read kernel memory via the copy_from_user call accessing an uninitialized stack buffer in the setsockopt pathway. The vulnerability is present in kernel versions prior to 2.4.34....

CVE-2007-5498

The CVE-2007-5498 issue affects the Xen hypervisor block backend driver for Linux kernel 2.6.18. When running on a 64-bit host with a 32-bit paravirtualized guest, a local privileged user in the guest can trigger a denial of service (host OS crash) by issuing a request that specifies a very large...

CVE-2010-0006

CVE-2010-0006 maps to a Linux kernel IPv6 extension header issue: the ipv6_hop_jumbo check in net/ipv6/exthdrs.c can dereference NULL when processing an invalid IPv6 jumbogram, causing remote denial of service. The affected line set is in kernels before 2.6.32.4, with network namespaces enabled. ...

CVE-2010-1187

The CVE-2010-1187 issue affects the Linux kernel TIPc (Transparent Inter-Process Communication) implementation, reported for kernel versions 2.6.16-rc1 through 2.6.33 (and potentially other versions). The vulnerability allows a local user to trigger a NULL pointer dereference and cause a kernel O...

CVE-2010-4256

CVE-2010-4256 affects the Linux kernel: the pipe_fcntl code in fs/pipe.c before 2.6.37 may misidentify named pipes, enabling a local user to cause a denial of service via an F_SETPIPE_SZ fcntl call. The issue is tracked across multiple advisories (e.g., Ubuntu USN-1083-1, RH advisories) and was f...

CVE-2011-2707

The CVE-2011-2707 entry affects the Linux kernel's arch/xtensa/kernel/ptrace.c, where the ptrace_setxregs() function does not validate user-space pointers. This allows a local user to read kernel memory via a crafted PTRACE_SETXTREGS request, as described for Linux kernel versions before 3.1. Pub...

CVE-2011-4325

CVE-2011-4325 – Linux kernel NFS vulnerability : The NFS implementation in the Linux kernel up to 2.6.31-rc6 can dereference uninitialized data, enabling a local denial-of-service via NULL pointer dereference and an O_DIRECT oops (e.g., demonstrated with diotest4 from LTP). Affected component: ke...

CVE-2012-5374

CVE-2012-5374: In the Linux kernel's Btrfs CRC32C hashing, pre-3.8-rc1 versions allow local users to trigger a denial of service by creating many files whose names map to the same CRC32C hash, extending kernel runtime. Verified by Nessus plugins describing a local DoS in Btrfs hashing within affe...

CVE-2013-1958

CVE-2013-1958 affects Linux kernels before 3.8.6 where scm_check_creds in net/core/scm.c fails to enforce capabilities for the PID value tied to a UNIX domain socket, allowing local users to bypass access controls during a window when a user namespace exists but a PID namespace is not yet created...

CVE-2015-2686

The CVE-2015-2686 issue affects the Linux kernel 3.19.x, specifically before 3.19.3. It arises from not validating certain range data for sendto/recvfrom in net/socket.c, enabling a local privilege escalation via a subsystem using the copy_from_iter function in the iov_iter interface, with the Bl...

CVE-2016-2061

CVE-2016-2061 is described in connected EulerOS/Nessus content as an integer signedness error in the Linux kernel MSM V4L2 video driver (3.x), used in Qualcomm QuIC MSM contributions. It can allow privilege escalation or a denial-of-service via a crafted application that triggers msm_isp_axi_crea...

CVE-2017-0523

CVE-2017-0523 is an elevation-of-privilege vulnerability in the Qualcomm Wi‑Fi driver that could allow a local malicious app to execute arbitrary code in the kernel. The CVSS3 vector indicates LOCAL access, high complexity, no privileges required, but user interaction is required; root cause is e...

CVE-2017-0563

CVE-2017-0563 is an elevation-of-privilege in the HTC touchscreen driver affecting the Android kernel (Kernel-3.10). A local malicious application could execute arbitrary code in the kernel context, potentially enabling a persistent device compromise that may require reflashing. The vulnerability...

CVE-2017-8067

The vulnerability CVE-2017-8067 affects the Linux kernel drivers/char/virtio_console.c in kernels 4.9.x and 4.10.x prior to 4.10.12, where improper interaction with CONFIG_VMAP_STACK allows a local user to cause a denial of service (system crash or memory corruption) or other impact by using more...

CVE-2019-18807

Two memory leaks in the Linux kernel sja1105_static_config_upload() (drivers/net/dsa/sja1105/sja1105_spi.c) before 5.3.5 can cause memory‑based DoS. The leaks arise when static_config_buf_prepare_for_upload() or sja1105_inhibit_tx() fail (CID‑68501df92d11). Affected product is the Linux kernel; v...

CVE-2019-18810

CVE-2019-18810 affects the Linux kernel before 5.3.8, specifically a memory leak in komeda_wb_connector_add() within drivers/gpu/drm/arm/display/komeda/komeda_wb_connector.c. An attacker can trigger memory growth by causing drm_writeback_connector_init() failures, leading to denial of service via...

CVE-2021-47092

Summary: CVE-2021-47092 relates to a Linux kernel KVM VMX issue where setting vmx->fail during emulation_required in L2 nesting was incorrect, potentially causing a VM-Exit/VM-Fail contradiction and a warning during teardown (nested_vmx_vmexit). The fix reverts that change so vmx->fail is n...

CVE-2021-47225

The Linux kernel 's mac80211 module contains a vulnerability where closing an active AP interface while its associated AP_VLAN interfaces are still up can trigger a deadlock . This occurs because the system attempts to acquire the wiphy mutex while it is already held during the dev_close() operat...

CVE-2021-47244

The CVE-2021-47244 entry concerns the Linux kernel mptcp option parsing (mptcp_get_options). The vulnerability is a potential out-of-bounds read when parsing TCP options: if an option’s length is 1, the parser loops and reads the opcode byte; if the opcode is not TCPOPT_EOL or TCPOPT_NOP, it read...

CVE-2022-3541

CVE-2022-3541 affects the Linux kernel Sunplus Ethernet driver (spl2sw_nvmem_get_mac_address in drivers/net/ethernet/sunplus/spl2sw_driver.c). The issue is a use-after-free vulnerability, as described in the initial document. Connected sources (Ubuntu USN advisories and Nessus/OpenVAS entries) co...

CVE-2022-48781

CVE-2022-48781 affects Linux kernel crypto: af_alg. The issue stems from removing alg_memory_allocated and an alg_proto memory_allocated field without a corresponding sysctl_mem, which makes sk_has_account() true and causes NULL pointer dereferences in sk_prot_mem_limits()/sock_reserve_memory whe...

CVE-2022-48952

CVE-2022-48952 affects the Linux kernel PCI mt7621 path. The issue was a missing sentinel in the soc_device_attribute array, causing an oops during soc_device_match(mt7621_pcie_quirks_match). The fix adds the required sentinel in the attribute table (commit 7c18b64bba3b) and updates mt7621 exposu...

CVE-2022-48986

CVE-2022-48986 is a Linux kernel issue in the memory management path (mm/gup) affecting devmap-backed dax mappings. The vulnerability arises from gup_pud_range() returning true for pud_huge() on x86 when hugetlb is configured, while dax does not depend on hugetlb. The fixes, including commits 414...

CVE-2022-49047

The Linux kernel is vulnerable to a Use-After-Free (UAF) flaw in the ep93xx_clk_register_gate() function located in the arch/arm/mach-ep93xx/clock.c module. This module supports Cirrus EP93xx processors . The vulnerability occurs because the system attempts to access memory at &psc->hw after t...

CVE-2022-49391

CVE-2022-49391 — Linux kernel remoteproc mtk_scp double free . The issue concerns the removal path for scp->rproc: it is allocated via devm_rproc_alloc(), so an explicit free in the remove function was unnecessary. The vulnerabilities describe a potential double free in the mtk_scp remoteproc ...

CVE-2022-49461

CVE-2022-49461 concerns the Linux kernel where the gateway’s handling of an advertising message fails to free relay information after extraction, causing a memory leak. The root cause is in the advertisement handler not freeing allocated relay data, leading to local memory exhaustion. Multiple co...

CVE-2022-49974

The CVE-2022-49974 vulnerability affects the Linux kernel HID Nintendo driver (drivers/hid/hid-nintendo.c) and stems from dereferencing a NULL pointer when queuing rumble work to a destroyed workqueue after disconnection, leading to a potential crash. The issue is mitigated by avoiding usage of t...

CVE-2022-49999

CVE-2022-49999 : In the Linux kernel, a race between caching free space for a block group and returning free space to the in‑memory space cache for pinned extents can cause double‑adding free space, corrupting the Btrfs free space tree and space cache. Symptoms include EEXIST when re‑adding freed...

CVE-2022-50024

CVE-2022-50024 affects the Linux kernel DMA engine (dmaengine) dw-axi-dmac. The issue occurs when axi_chan_dump_lli() is given a NULL LLI pointer, which can trigger an OOPS by attempting to read fields from a NULL structure. The fix is to print a NULL LLI and exit instead of dereferencing it. Aff...

CVE-2022-50047

The CVE-2022-50047 issue affects the Linux kernel’s net: dsa mv88e6060 code. When a port is neither a CPU port nor a user port, cpu_dp can be NULL, causing a NULL pointer dereference and kernel crash during mv88e6060_setup_port(). This is a local impact vulnerability that leads to a crash; connec...

CVE-2022-50077

The CVE-2022-50077 entry concerns the Linux kernel AppArmor path aa_pivotroot, where a reference-count bug leaks a previously incremented “target” when aa_replace_current_label() returns success. The fix is to decrement the refcount of target in that code path (build_pivotroot() increased it earl...

CVE-2022-50097

CVE-2022-50097 affects the Linux kernel’s video fbdev s3fb driver. The bug arises in s3fb_set_par() where the code computes screen_size from user input and can exceed info->screen_size, leading to a kernel PAGE_FAULT on write (local access) during memset_io. The issue is mitigated by the docum...

CVE-2022-50098

Technical details for CVE-2022-50098 are not provided in the supplied documents; monitor vendor advisories for updates.

CVE-2022-50141

In CVE-2022-50141, the Linux kernel component mmc: sdhci-of-esdhc had a refcount leak in esdhc_signal_voltage_switch caused by of_find_matching_node() returning a node pointer with an incremented refcount. The fix adds a missing of_node_put() to release refs when the node is no longer needed, pre...

CVE-2022-50176

In CVE-2022-50176, the Linux kernel’s drm/mcde mcde_dsi_bind had a refcount leak: every iteration of for_each_available_child_of_node() decremented the previous node’s refcount, but a missing of_node_put() on loop exit caused leaks. The fix is to add of_node_put() to restore correct refcount hand...

CVE-2022-50184

The CVE-2022-50184 issue in the Linux kernel concerns a refcount leak in the Meson HDMI encoder path. Specifically, in drm/meson: encoder_hdmi_init, of_graph_get_remote_node() returns a remote device node pointer with an incremented refcount, and a missing of_node_put() could lead to a leak. The ...

CVE-2023-20712

CVE-2023-20712 affects MediaTek WLAN code (wlan module) and is due to a missing bounds check, enabling an out-of-bounds write that can yield local privilege escalation to System level. Exploit requires LOCAL access with HIGH privileges and no user interaction. Patch: ALPS07796914 (Issue ALPS07796...