CVE-2005-3847

CVE-2005-3847 affects Linux kernel 2.6.11 up to but not including 2.6.13 and 2.6.12.6, allowing local users to cause a deadlock by sending SIGKILL to a real-time thread that is dumping core. SUSE/ Debian OpenVOS references confirm the issue and its remediation. The known fix is in 2.6.12.6 via th...

CVE-2005-3848

CVE-2005-3848 concerns a memory leak in the Linux kernel’s icmp_push_reply() that can be triggered by crafting a large number of ICMP packets, causing memory consumption and a denial of service. Public details in the initial entry specify Linux kernels before 2.6.12.6 and 2.6.13 are affected, wit...

CVE-2006-0456

CVE-2006-0456 affects the Linux kernel prior to 2.6.16 on IBM S/390, where strnlen_user can return an incorrect value. This can enable local users to cause a denial of service via unknown vectors. Connected sources confirm the issue and reference the IBM S/390/strnlen_user function, with remediat...

CVE-2006-0482

CVE-2006-0482 affects Linux kernel 2.6.x on SPARC; get_compat_timespec() sanitization is insufficient, enabling local denial of service (hang) via date -s. Debian DSAs document a fix in kernel-source-2.6.8 packages (e.g., 2.6.8-16sarge2) and kernel upgrades; systems should upgrade and reboot to m...

CVE-2006-1242

CVE-2006-1242 affects the Linux kernel (2.4.x and 2.6.x up to before 2.6.16). The ip_push_pending_frames function increments the IP ID when sending a RST after unsolicited TCP SYN-ACKs, enabling remote Idle-Scan (nmap -sI) bypassing certain protections. Affected versions: Linux 2.4.x and 2.6.x be...

CVE-2008-2148

CVE-2008-2148 affects the Linux kernel: UTIME_NOW/UTIME_OMIT handling in sys_utimensat in 2.6.22 and older than 2.6.25.3 allows a local user to modify the timestamps of arbitrary files, potentially causing a denial of service. The root cause is improper permission checks for certain UTIME_NOW/UTI...

CVE-2008-7256

CVE-2008-7256 affects the Linux kernel’s mm/shmem.c prior to 2.6.28-rc8 when strict overcommit is enabled and CONFIG_SECURITY is disabled. The vulnerability arises in how knfsd exports shmemfs objects, allowing a denial of service via NULL pointer dereference and knfsd crash, with possible other ...

CVE-2011-4916

CVE-2011-4916 affects the Linux kernel up to version 3.1, where local users could access /dev/pts/ and /dev/tty* to obtain sensitive keystroke information. The available connected sources (OSV/DEBIAN/NVD-style entries) confirm the local-priority impact but do not provide specific patch versions o...

CVE-2012-6703

CVE-2012-6703: Integer overflow in Linux kernel ALSA snd_compr_allocate_buffer (sound/core/compress_offload.c) allows local users to trigger denial of service via crafted SNDRV_COMPRESS_SET_PARAMS; affected until 3.6-rc6-next-20120917. Connected documents confirm the exact function and patch time...

CVE-2015-8019

The CVE-2015-8019 entry concerns the Linux kernel up to at least versions 3.14.54 and 3.18.22, where skb_copy_and_csum_datagram_iovec does not enforce a length argument. Root cause: a missing length argument in the function affects data handling in datagram processing, enabling local users to tri...

CVE-2016-8417

CVE-2016-8417 describes an elevation-of-privilege vulnerability in the Qualcomm camera driver on Android. The issue could let a local malicious application execute arbitrary code in the kernel context by exploiting the Qualcomm camera driver (in Android kernel versions 3.10 and 3.18). The vulnera...

CVE-2016-9120

CVE-2016-9120 affects the Linux kernel’s Ion framework: a race condition in ion_ioctl (ion.c) before 4.6 allows local privilege escalation or DoS when ION_IOC_FREE is invoked concurrently on two CPUs. Root cause is a race in the ion_ioctl path. Impact per documents is high (privilege gain/DoS). R...

CVE-2017-0329

CVE-2017-0329 is an elevation-of-privilege in the NVIDIA boot and power management processor driver on Android (Kernel 3.18). It could allow a local malicious application to execute arbitrary code within the boot/power management context after compromising a privileged process. The entry is backe...

CVE-2017-0571

CVE-2017-0571 stems from Broadcom’s Wi‑Fi driver (bcmdhd) on Android. A WLFC TLV parity parsing path fails to validate length fields, allowing an attacker controlling the dongle to craft a TLV with a large length (e.g., 255) which overflows a stack buffer, enabling local code execution in the ker...

CVE-2017-0579

CVE-2017-0579 is a local elevation-of-privilege issue in the Qualcomm Video driver on Android, enabling a local malicious app to execute arbitrary kernel code. Affected: Android kernel 3.10 and 3.18; root cause: Qualcomm video driver elevation of privilege. Exploitation status is not detailed in ...

CVE-2017-8062

CVE-2017-8062 concerns the Linux kernel vulnerability in drivers/media/usb/dvb-usb/dw2102.c. The issue affects kernel series 4.9.x and 4.10.x prior to 4.10.4, where interaction with CONFIG_VMAP_STACK can allow a local user to trigger a denial of service (system crash or memory corruption) or othe...

CVE-2021-47129

CVE-2021-47129 (Linux kernel) : The netfilter nft_ct logic could trigger invalid CT helper usage. Specifically, nft_ct_expect_obj_eval() called nf_ct_ext_add() for a confirmed conntrack entry, but nf_ct_ext_add() only accepts unconfirmed entries, causing an invalid path and warning in nf_conntrac...

CVE-2022-48719

CVE-2022-48719 concerns a Linux kernel issue in the neighbor subsystem where an NUD_FAILED entry could trigger an immediate probe due to neigh_event_send behavior when under certain managed state conditions. The root cause involved a potential deadlock path with NTF_MANAGED entries and a chain of...

CVE-2022-48874

The CVE-2022-48874 issue is in the Linux kernel fastrpc subsystem. The description specifies a race condition between fastrpc_map_lookup() unlocking a mutex and the reference count increment in fastrpc_map_find() via fastrpc_map_get(), which can lead to use-after-free. The proposed fix merges fas...

CVE-2022-48878

CVE-2022-48878 affects the Linux kernel Bluetooth stack (hci_qca) and the serdev shutdown path. The issue arises when the HCI device is not open (e.g., hci_dev_open_sync() failed) and the shutdown callback may still attempt to send EDL_SOC_RESET over serdev, potentially triggering a use-after-fre...

CVE-2022-48906

CVE-2022-48906 affects the Linux kernel MPTCP implementation (DATA_FIN timeout calculation in net/mptcp/protocol.c). Syzkaller/UBSAN revealed a shift-out-of-bounds when many DATA_FIN retransmits occur, causing timeout miscalculation. The fix limits the maximum timeout by restricting the shift siz...

CVE-2022-48932

CVE-2022-48932 affects the Linux kernel (net/mlx5). The issue is a slab-out-of-bounds in mlx5_cmd_dr_create_fte when adding a rule with 32 destinations, leading to a bug seen as KASAN slab-out-of-bounds. The patch fixes this by increasing allocated buffers to accommodate the needed actions and by...

CVE-2022-49048

CVE-2022-49048 (Linux kernel) : The vulnerability relates to the IPv6 forwarding path where a kernel panic can occur in ip6_forward() if the input interface has no in6 device. The issue has been resolved in the Linux kernel (as described in multiple advisories), with reproduction steps involving ...

CVE-2022-49391

CVE-2022-49391 — Linux kernel remoteproc mtk_scp double free . The issue concerns the removal path for scp->rproc: it is allocated via devm_rproc_alloc(), so an explicit free in the remove function was unnecessary. The vulnerabilities describe a potential double free in the mtk_scp remoteproc ...

CVE-2022-49747

Summary (concrete details found in connected docs): CVE-2022-49747 refers to a Linux kernel issue where the offset calculation in erofs/zmap.c was incorrect, causing iomap->length to be set to 0 and triggering a WARN_ON in iomap_iter_done(). The issue affects the kernel’s handling path involvi...

CVE-2022-49844

The collection confirms CVE-2022-49844 affects the Linux kernel CAN subsystem. The issue arises from reading priv->ctrlmode in virtual CAN interfaces (e.g., vcan, vxcan) when some interfaces do not create struct can_priv at startup, causing an out-of-bounds read and CAN frame drops. The refere...

CVE-2022-49932

CVE-2022-49932 affects the Linux kernel KVM/vMX path where /dev/kvm is exposed before VMX initialization is complete. The EulerOS advisories (EulerOS-SA-2025-2464/2483, EulerOS-SA-2025-2436/2447) flag this issue as part of kernel fixes and describe the root cause as incomplete initialization prio...

CVE-2022-50183

Summary: CVE-2022-50183 affects the Linux kernel’s DRM Meson encoder_cvbs path. The issue is a refcount leak in the initialization flow of meson_encoder_cvbs_init, caused by not calling of_node_put() on the remote node obtained via of_graph_get_remote_node(). This leads to a local leak in the ref...

CVE-2023-4130

CVE-2023-4130 : In the Linux kernel’s ksmbd SMB2 handling, there is a vulnerability due to wrong next length validation of the ea buffer in smb2_set_ea(). When multiple smb2_ea_info buffers are in FILE_FULL_EA_INFORMATION, ksmbd iterates using NextEntryOffset and validates only with that offset i...

CVE-2023-52770

CVE-2023-52770 is a Linux-kernel (f2fs) issue: the bug stems from how extent_cache is allocated, with a split between initial and dynamic conditions that could trigger a panic during extent_cache updates (observed during a file creation with compressed flag and subsequent operations). The vulnera...

CVE-2023-52909

CVE-2023-52909: In the Linux kernel NFSD, a race in caching an opened NFSv4 file could leave nf_file NULL or leak a prior nf_file. The fix introduces nfsd_file_acquirei_opened, which uses an existing file pointer when present and preserves an existing valid nf_file, preventing leaks and oops. It ...

CVE-2023-53003

CVE-2023-53003 concerns a use-after-free in the Linux kernel’s EDAC/qcom path. The LLCC driver allocates llcc_driv_data, which was previously passed as private info to the EDAC core (edac_device_ctl_info). On driver release this data could be freed, and a subsequent probe would use the freed memo...

CVE-2024-40952

CVE-2024-40952 affects the Linux kernel ocfs2 path, causing a NULL pointer dereference in ocfs2_journal_dirty() after bdev->bd_super was replaced with b_assoc_map->host->i_sb, when b_assoc_map isn’t initialized. The fix described in the connected documents is to abort the transaction and...

CVE-2024-43822

CVE-2024-43822 is a Linux kernel vulnerability affecting the ASoc PCM6240 path, where a failed devm_kzalloc() in pcmdevice_i2c_probe() previously allowed a pcmdevice_remove() with a null pointer, risking dereference. The root cause is returning the wrong error path after an allocation failure, wh...

CVE-2024-57919

CVE-2024-57919: In the Linux kernel, the drm/amd/display path (dm_get_plane_scale) diverts a divide-by-zero when the destination plane size is zero, leading to a kernel oops. The fix sets out-scale size to zero when dst size is zero (consistent with drm_calc_scale), addressing cursor overlay logi...

CVE-2024-58062

CVE-2024-58062: In the Linux kernel, the iwlwifi mvm code was fixed to avoid NULL pointer dereference when iterating over active links of a virtual interface (vif). The root cause was a missing check that the link pointer exists before dereferencing it; the patch adds usage of for_each_vif_active...

CVE-2025-21940

Technical details about CVE-2025-21940 are not publicly provided in the supplied documents. No affected products, versions, or fixes are explicitly described here. Monitor for vendor advisories and patch releases.

CVE-2025-37939

CVE-2025-37939 affects the Linux kernel in the libbpf component, specifically the BTF.ext core_relo header handling. The issue arises when btf_ext_parse_info() reads fields of the core_relo header without confirming its presence, potentially triggering a buffer read overflow as reported by OSS-Fu...

CVE-2001-1398

The CVE-2001-1398 issue affects the Linux kernel prior to 2.2.19, arising from the masquerading code where packet length checks were lax, potentially enabling kernel memory writes via the CPIA driver off-by-one bug. Confirmed in multiple advisories (Mandrake MDKSA-2001:037 and Debian/Debian DSA-0...

CVE-2005-0137

CVE-2005-0137 refers to a vulnerability in the Linux kernel 2.6 on Itanium (ia64) where a missing Itanium syscall table entry could be exploited by a local user to trigger a denial of service. The core issue is a kernel-level handling gap for an Itanium syscall entry, enabling a local attacker to...

CVE-2006-0457

CVE-2006-0457 is a race condition in the Linux kernel 2.6.x key-control flow (add_key, request_key, keyctl). The bug allows local users to crash the kernel or read sensitive kernel memory by altering the length of a string argument between the kernel calculating length and copying data into kerne...

CVE-2006-1522

CVE-2006-1522 affects Linux kernel 2.6.16.1 and 2.6.17-rc1 (and possibly earlier). The sys_add_key function in the keyring code may add a key to a user key instead of a keyring, causing an invalid dereference in __keyring_search_one and resulting in a local DoS (OOPS) / kernel crash. The vulnerab...

CVE-2006-1860

CVE-2006-1860 affects the Linux kernel up to and including 2.6.16.15, with the fix released in 2.6.16.16. The issue is in lease_init (fs/locks.c) where a lock could be freed that might not have been allocated on the stack, allowing a local attacker to cause a denial of service (fcntl_setlease loc...

CVE-2006-5173

CVE-2006-5173 concerns the Linux kernel: local users can trigger a denial-of-service by mismanaging EFLAGS during context switches and thread creation (Alignment Check flag 0x40000), causing SIGBUS in other processes with unaligned accesses. Multiple connected sources confirm the issue and refere...

CVE-2006-6535

CVE-2006-6535 affects the Linux kernel 2.6 series, where a flaw in the dev_queue_xmit() error handling path in the network subsystem can lead to data corruption. Multiple advisories and scanners (e.g., Debian DSA-1304-1, Red Hat/CentOS RHSA-2007:0014, OpenVAS entries) map this to a local data cor...

CVE-2007-4311

The CVE-2007-4311 issue affects the Linux kernel random driver (drivers/char/random.c) where reseed operations reuse only the first bytes of a buffer due to incorrect use of sizeof, reducing entropy and potentially making RNG output more predictable. It is described for Linux 2.4.x builds prior t...

CVE-2008-0352

CVE-2008-0352 affects the Linux kernel 2.6.20–2.6.21.1. A remote attacker can cause a denial of service (panic) by sending a certain IPv6 packet, possibly involving the Jumbo Payload hop-by-hop option (jumbogram). The issue has a known fix in 2.6.21.2 (and later); apply the kernel update to mitig...

CVE-2011-2211

CVE-2011-2211 concerns the Linux kernel on the Alpha architecture. The vulnerability lies in the osf_wait4 function (arch/alpha/kernel/osf_sys.c), where an incorrect pointer is used in versions prior to 2.6.39.4. This can allow local users to gain elevated privileges by writing a specific integer...

CVE-2011-2493

The CVE-2011-2493 entry affects the Linux kernel, specifically the ext4_fill_super function in fs/ext4/super.c, with vulnerability present in versions prior to 2.6.39. The issue arises from improper initialization of an error-report data structure, enabling local users to cause a denial of servic...

CVE-2013-2058

The CVE-2013-2058 issue affects the Linux kernel prior to 3.7.4, specifically the host_start function in drivers/usb/chipidea/host.c. Affected code does not properly handle a certain non‑streaming option, enabling a local attacker to trigger a denial of service (system crash) by sending a large a...