CVE-2005-1264

The CVE-2005-1264 issue is a concrete flaw in Linux kernel 2.6.x where raw devices (raw.c) call the wrong function before passing an ioctl to block devices, exposing kernel address space to userspace. This local, privilege-escalation risk is corroborated across multiple advisories (e.g., RHSA-200...

CVE-2005-3358

CVE-2005-3358 affects Linux kernel prior to 2.6.15: passing a 0 bitmask to set_mempolicy can trigger a kernel panic, enabling local denial of service. Public details in Debian DSAs and OpenVAS entries confirm the issue and list patched kernel versions (e.g., Debian 2.6.8-16sarge2; Red Hat/CentOS ...

CVE-2005-3858

Technical details about CVE-2005-3858 are not publicly available in the provided connected documents. Monitor for updates.

CVE-2006-6060

CVE-2006-6060 affects the Linux kernel 2.6.x family (notably up to 2.6.18) where a malformed NTFS file stream can trigger an infinite loop in __find_get_block_slow, causing local CPU exhaustion (DoS). Connected sources confirm this CVE is listed across Debian, SUSE/openSUSE advisories and kernel ...

CVE-2007-3850

The CVE-2007-3850 issue affects the Linux kernel 2.6 series running on PowerPC, where the eHCA driver fails to map userspace resources correctly. This allows local users to read portions of physical address space, revealing potentially sensitive information. The description explicitly ties this t...

CVE-2009-2768

The vulnerability CVE-2009-2768 affects the Linux kernel flat subsystem (fs/binfmt_flat.c: load_flat_shared_library). It allows local users to trigger a NULL pointer dereference by executing a shared flat binary, potentially causing a denial of service and system crash, via an uninitialized cred ...

CVE-2013-2058

The CVE-2013-2058 issue affects the Linux kernel prior to 3.7.4, specifically the host_start function in drivers/usb/chipidea/host.c. Affected code does not properly handle a certain non‑streaming option, enabling a local attacker to trigger a denial of service (system crash) by sending a large a...

CVE-2015-7884

The CVE-2015-7884 issue affects the Linux kernel’s vivid-osd driver (vivid_fb_ioctl) which does not initialize a structure member, allowing local attackers to read kernel memory. Public advisories in openSUSE and Mageia document the same CVE and indicate remediation via kernel updates; e.g., open...

CVE-2015-8019

The CVE-2015-8019 entry concerns the Linux kernel up to at least versions 3.14.54 and 3.18.22, where skb_copy_and_csum_datagram_iovec does not enforce a length argument. Root cause: a missing length argument in the function affects data handling in datagram processing, enabling local users to tri...

CVE-2016-8424

CVE-2016-8424 is an elevation-of-privilege in the NVIDIA Tegra GPU driver (NVMAP) that can let a local, unprivileged process execute code in kernel context by referencing memory after it has been freed (use-after-free). Affected: Android devices using the NVIDIA Tegra kernel driver (Kernel-3.10)....

CVE-2016-9313

CVE-2016-9313 affects the Linux kernel in security/keys/big_key.c (big_key data type). The issue arises when unsuccessful crypto registration occurs in conjunction with a subsequent key-type registration, enabling local users to trigger a NULL pointer dereference and kernel panic (denial of servi...

CVE-2017-0460

CVE-2017-0460 describes a local elevation-of-privilege in the Qualcomm networking driver on Android, allowing a malicious local app to execute code in the kernel. Affected are Android kernels 3.10 and 3.18; the exploit requires compromising a privileged process and does not appear to be remotely ...

CVE-2021-47125

CVE-2021-47125 concerns a Linux kernel local vulnerability due to a refcount leak in the HTB offload path. The root cause was an incorrect NULL handling around qdisc_refcount_inc in htb_parent_to_leaf_offload, which could leak references if new_q was NULL. The fix adds a NULL pointer check to gua...

CVE-2021-47298

CVE-2021-47298 concerns the Linux kernel: a bpf/sockmap path could leak a message if skb_linearize fails, resolved by freeing the msg block before returning an error. Multiple connected advisories reference the same fix in the kernel; impact is a potential memory leak (no exploitation details pro...

CVE-2021-47502

CVE-2021-47502 relates to the Linux kernel ASoC: codecs: wcd934x driver. The issue is improper handling of channel mapping lists where a channel could be added to multiple DAI channel lists, risking corruption of a list that already contains the channel. The linked Astra Linux advisory confirms a...

CVE-2022-3170

CVE-2022-3170 affects the Linux kernel sound subsystem. The vulnerability is an out-of-bounds access that can occur when the user-provided id->name does not end with a NUL character, allowing a privileged local user to trigger a crash or potentially escalate privileges via an ioctl() path. The...

CVE-2022-48835

CVE-2022-48835 involves a page fault in the Linux kernel driver mpt3sas (SCSI) on a LUN reset path. A faulty invalid reply_q pointer used by mpt3sas_base_sync_reply_irqs leads to a kernel oops when processing reply queues; the described mitigation is to move the _base_process_reply_queue() call i...

CVE-2022-48869

CVE-2022-48869 concerns the Linux kernel gadgetfs USB driver. The issue arises from a race between gadgetfs_fill_super() (mount path) and gadgetfs_kill_sb() (unmount path), where the_device could be deallocated while gadgetfs_fill_super() still uses it, resulting in a use-after-free. The provided...

CVE-2022-48878

CVE-2022-48878 affects the Linux kernel Bluetooth stack (hci_qca) and the serdev shutdown path. The issue arises when the HCI device is not open (e.g., hci_dev_open_sync() failed) and the shutdown callback may still attempt to send EDL_SOC_RESET over serdev, potentially triggering a use-after-fre...

CVE-2022-48889

CVE-2022-48889 - Linux kernel ASoC: Intel sof-nau8825 alias overflow . The issue arises from the 20-character limit for a platform_device_id entry (including the trailing NUL). The sof_nau8825.c file exceeded this limit, causing a build error: illegal character encoding in string literal in MODUL...

CVE-2022-48903

The CVE-2022-48903 entry refers to a Linux kernel vulnerability in the btrfs relocation path: a premature return from btrfs_commit_transaction can cause relocation-related crashes. The connected documents indicate upstream fixes in the kernel (e.g., commits addressing btrfs_relocate_block_group a...

CVE-2022-48906

CVE-2022-48906 affects the Linux kernel MPTCP implementation (DATA_FIN timeout calculation in net/mptcp/protocol.c). Syzkaller/UBSAN revealed a shift-out-of-bounds when many DATA_FIN retransmits occur, causing timeout miscalculation. The fix limits the maximum timeout by restricting the shift siz...

CVE-2022-49146

The CVE-2022-49146 entry describes a Linux kernel issue in virtio handling where drivers bypass the enable_cbs callback during virtio_device_restore(), causing suspend-resume traces and potential interrupt handling problems. The root cause is failure to call virtio_device_ready() in restore, so i...

CVE-2022-49452

The CVE-2022-49452 issue concerns the Linux kernel DPAA2 Ethernet driver (dpaa2-eth). The vulnerability arises when the virtual address is retrieved after DMA unmapped in TSO path, leading to an invalid address being used in kfree. A fix was implemented to call dpaa2_iova_to_virt() before the dma...

CVE-2022-49654

CVE-2022-49654 pertains to the Linux kernel, specifically the net: dsa: qca8k component. The issue occurs when MAX_FRAME_SIZE (MTU) is changed while the CPU port is enabled, causing the switch to panic and stop sending packets, which can render the device unreachable; a switch reset may be requir...

CVE-2022-49684

The Connected documents confirm CVE-2022-49684 relates to the Linux kernel, specifically the iio: adc: aspeed code. The issue is a refcount leak in aspeed_adc_set_trim_data caused by of_find_node_by_name() returning a node pointer with an incremented refcount; the remediation is to call of_node_p...

CVE-2022-49817

Summary of CVE-2022-49817 (Linux kernel) : The MHI network driver (mhi_net_dellink) leaked memory because it registered a net device without setting needs_free_netdev and did not call free_netdev on unregister. The concrete remediation is a patch that adds free_netdev() usage since netdev_priv is...

CVE-2022-49831

The CVE relates to the Linux kernel btrfs zoned feature. The issue occurs during seeding on a zoned filesystem if each zoned device’s btrfs_zoned_device_info is not initialized, causing a NULL pointer dereference when mounting. Multiple sources confirm this vulnerability and its resolution in the...

CVE-2022-50188

CVE-2022-50188 is a Linux kernel vulnerability where a refcount leak in drm/meson was fixed. The issue arose because of how of_find_device_by_node() held a reference, with missing put_device() in the error path, leading to a refcount leak. The fix patches the kernel (meson_encoder_hdmi_init) to r...

CVE-2023-20715

CVE-2023-20715 affects the wlan component in MediaTek-based devices. The issue is an out-of-bounds write caused by a missing bounds check, enabling local escalation of privileges with SYSTEM execution rights required. Exploitation reportedly does not require user interaction. The vulnerability’s ...

CVE-2023-4130

The CVE-2023-4130 issue affects the Linux kernel’s ksmbd implementation for SMB2 set_ea(), where multiple smb2_ea_info buffers in a FILE_FULL_EA_INFORMATION request were parsed by iterating with NextEntryOffset. The root cause is incorrect validation of the next buffer length: ksmbd used the Next...

CVE-2024-43815

CVE-2024-43815 affects the Linux kernel crypto/mxs-dcp path. The vulnerability could leak stack memory via the AES payload field when using a hardware key from a key slot; the fix sets the payload field to 0 in these cases. The common path, where the key comes from main memory via the descriptor ...

CVE-2024-50097

CVE-2024-50097 is resolved in OpenSUSE kernel-devel-longterm-6.12.11-1.1 on GA media. The issue in the Linux kernel’s fec driver could panics when saving PTP state if PTP is unsupported; the fix guards fec_ptp_save_state behind a PTP-support check, preventing the unconditional state save. Technic...

CVE-2024-57905

In CVE-2024-57905, Linux kernel iio: adc: ti-ads1119 is fixed: the scan path pushed data from a triggered buffer used a local struct with an uninitialized hole between sample and timestamp, risking information leakage to userspace. The fix initializes the scan struct to zero before use to avoid p...

CVE-2024-57988

In the Linux kernel, the Bluetooth driver btbcm had a NULL pointer dereference in btbcm_get_board_name() when devm_kstrdup() could return NULL. The fix adds a NULL check in btbcm_get_board_name() to prevent the dereference.

CVE-2025-21843

CVE-2025-21843 concerns the Linux kernel DRM panthor component (panthor_ioctl_dev_query). The issue is that priorities_info is uninitialized and its value can be copied to a user object when PANTHOR_UOBJ_SET() is invoked. The documented fix is to initialize priorities_info (e.g., via memset) to a...

CVE-2025-21940

Technical details about CVE-2025-21940 are not publicly provided in the supplied documents. No affected products, versions, or fixes are explicitly described here. Monitor for vendor advisories and patch releases.

CVE-2025-38515

CVE-2025-38515 concerns a race in the Linux kernel’s DRM scheduler. The description states a small race between drm/sched spsc_queue_push and the run-job worker, where spsc_queue_push may return not-first while the worker has idled due to the job count reaching zero. The consequence is that job s...

CVE-2025-38561

CVE-2025-38561 concerns the ksmbd component of the Linux kernel. A race condition on Preauh_HashValue may occur when a client sends multiple session setup requests to ksmbd, due to how sess->Preauh_HashValue was previously freed during session setup. The fix moves freeing of sess->Preauh_Ha...

CVE-2025-38623

The CVE-2025-38623 entry describes a Linux kernel fix in PCI: pnv_php hotplug handling. The vulnerability stemmed from improper handling of surprise plug events, enabling a PE bridge to freeze MSI interrupt paths and leaving PHB/PE in a frozen state after removal. Consequences include stalled plu...

CVE-2026-46056

The CVE-2026-46056 entry documents a Linux kernel Bluetooth UAF vulnerability in the SSP passkey handlers (hci_event path). The issue arises when hci_conn lookup and field access are performed without holding the hdev lock, creating a window where a connection could be freed concurrently in hci_u...

CVE-2026-46230

CVE-2026-46230 affects the Linux kernel’s drm/amdgpu/vcn3 component. The vulnerability is an Out-of-Bounds read during decoder message parsing, due to missing bounds checks; the fix adds checks against the end of the BO before msg access. Impact is described as high severity (CVSSv3.1: Local, Low...

CVE-2026-46241

CVE-2026-46241 concerns the SPI driver for the MPC52xx in the Linux kernel, where a use-after-free can occur if controller registration fails because interrupts are not properly disabled and freed. The issue is resolved by a fix that ensures interrupts are disabled and resources freed on registra...

CVE-1999-0628

The CVE-1999-0628 issue involves the rwho/rwhod service, which exposes machine status and user information. Documents reference the vulnerable component as the rwho/rwhod service; no specific product/vendor/version is named. The impact description indicates partial confidentiality exposure, with ...

CVE-2001-0316

CVE-2001-0316 affects Linux kernels 2.2 and 2.4 where sysctl can be invoked with a negative length, allowing unprivileged local users to read kernel memory and potentially obtain root privileges. Mitigation in the public records points to upgrading to kernel 2.2.19 or later (and vendor advisories...

CVE-2001-0851

CVE-2001-0851 covers the Linux kernel 2.0, 2.2 and 2.4 with syncookies enabled. The issue arises from the syncookie handling that allows a remote attacker to bypass firewall rules by brute-forcing the cookie, effectively defeating first-hop filtering. Public advisories from Red Hat, SUSE, Mandrak...

CVE-2004-1333

The CVE-2004-1333 entry describes an integer overflow in the vc_resize function of Linux kernel 2.4 and 2.6 before 2.6.10, which allows local users to trigger a kernel crash (DoS) via a short new screen value that leads to a buffer overflow. This is the only concrete detail provided in the initia...

CVE-2005-0532

The CVE-2005-0532 issue affects the Linux kernel: the reiserfs_copy_from_user_to_file_region function in reiserfs/file.c is vulnerable on 64-bit architectures for kernel 2.6.10/2.6.11 before 2.6.11-rc4, where casting discrepancies between size_t and int can trigger a local buffer overflow. Impact...

CVE-2005-1913

CVE-2005-1913 affects the Linux kernel up to version 2.6.12.1. The vulnerability occurs when a non group-leader thread executes a different program while an itimer is pending; the expiry signal is delivered to the old group-leader task, which no longer exists, causing a kernel panic (local DoS). ...

CVE-2006-1342

CVE-2006-1342 is a local information-leak in the Linux kernel’s IPv4 socket-name handling. The root cause is that sockaddr_in.sin_zero is not cleared when returning IPv4 socket names from getsockname, getpeername, or accept, potentially exposing portions of kernel memory. Public advisories across...