CVE-2006-1368

CVE-2006-1368 affects the Linux kernel USB Gadget RNDIS driver. The vulnerability is a buffer overrun in the RNDIS response handling: during a remote NDIS response to OID_GEN_SUPPORTED_LIST the code allocates memory for the reply data but not for the reply structure, enabling a boundary condition...

CVE-2008-2148

CVE-2008-2148 affects the Linux kernel: UTIME_NOW/UTIME_OMIT handling in sys_utimensat in 2.6.22 and older than 2.6.25.3 allows a local user to modify the timestamps of arbitrary files, potentially causing a denial of service. The root cause is improper permission checks for certain UTIME_NOW/UTI...

CVE-2008-2944

CVE-2008-2944 describes a double-free vulnerability in the Linux kernel’s utrace support, likely affecting 2.6.18-era builds, reported in Red Hat Enterprise Linux 5 and Fedora Core 6. Impact: local users can trigger a denial of service (o o p s) via a crash when running the GNU GDB testsuite; thi...

CVE-2012-6703

CVE-2012-6703: Integer overflow in Linux kernel ALSA snd_compr_allocate_buffer (sound/core/compress_offload.c) allows local users to trigger denial of service via crafted SNDRV_COMPRESS_SET_PARAMS; affected until 3.6-rc6-next-20120917. Connected documents confirm the exact function and patch time...

CVE-2013-1858

The CVE-2013-1858 issue affects the Linux kernel prior to 3.8.3, where the clone system-call mishandles a combination of CLONE_NEWUSER and CLONE_FS. This enables local users to escalate privileges by calling chroot and taking advantage of the sharing of the / directory between a parent process an...

CVE-2013-2636

The CVE-2013-2636 entry concerns the Linux kernel prior to 3.8.4, where net/bridge/br_mdb.c does not initialize certain structures. This can allow local users to read sensitive kernel memory via a crafted application. The issue is addressed by the 3.8.4 update (ChangeLog-3.8.4); remediation is to...

CVE-2013-6432

CVE-2013-6432 affects the Linux kernel ping_recvmsg in net/ipv4/ping.c and can cause a local denial of service via a NULL pointer dereference when interacting with read() on ping sockets. The vulnerability exists in kernel versions prior to 3.12.4. The provided connected documents corroborate the...

CVE-2014-4323

The CVE-2014-4323 issue affects the Linux kernel 3.x MDP display driver (mdp_lut_hw_update in drivers/video/msm/mdp.c) used in Qualcomm QuIC Android MSM contributions. The vulnerability stems from insufficient validation of certain start and length values in an ioctl call, enabling privilege esca...

CVE-2017-0439

CVE-2017-0439 describes a local privilege-escalation vulnerability in the Qualcomm Wi‑Fi driver for Android, affecting Kernel-3.10 and Kernel-3.18. The issue could allow a local malicious app to execute arbitrary code in the kernel context after compromising a privileged process. The Android Prod...

CVE-2017-0531

CVE-2017-0531 is an information-disclosure vulnerability in the Qualcomm Wi‑Fi driver for Android, allowing a local malicious application to access data outside its permission levels after compromising a privileged process. Affected components/versions are Android kernel build lines (Kernel-3.10 ...

CVE-2017-7979

CVE-2017-7979 affects the Linux kernel 4.11.x via the packet action API (net/sched/act_api.c). The vulnerability arises from mishandling the tb nlattr array in the cookie feature, enabling a local attacker to trigger denial of service through uninitialized memory access and a refcount underflow, ...

CVE-2017-8062

CVE-2017-8062 concerns the Linux kernel vulnerability in drivers/media/usb/dvb-usb/dw2102.c. The issue affects kernel series 4.9.x and 4.10.x prior to 4.10.4, where interaction with CONFIG_VMAP_STACK can allow a local user to trigger a denial of service (system crash or memory corruption) or othe...

CVE-2020-36790

The CVE-2020-36790 entry refers to a Linux kernel issue where a memory leak in nvmet was fixed: specifically, the code failed to free the new_model_number. The connected documents consistently identify this as a resolved kernel vulnerability (nvmet: fix a memory leak) with no additional exploit d...

CVE-2021-47251

Summary: CVE-2021-47251 affects the Linux kernel’s wireless stack via mac80211, where the skb length check in ieee80211_scan_rx() was corrected. The fix replaces hard-coded header-length constants with dynamic calculation based on the frame type, preventing a validation WARN_ON in cfg80211 later....

CVE-2021-47519

CVE-2021-47519 concerns the Linux kernel CAN subsystem, specifically a memory leak in can/m_can_read_fifo. According to connected sources, if the second call to m_can_fifo_read() fails, code paths jump to an out_fail label and return before freeing the skb created by alloc_can_skb(), resulting in...

CVE-2021-47593

CVE-2021-47593 concerns the Linux kernel mptcp ULP, where the kernel flag handling for fallback sockets could allow a plain TCP subflow to retain kernel ownership and trigger a kernel crash. The issue occurs when accept() returns a plain TCP sk that is still tagged as kernel, allowing setsockopt ...

CVE-2022-48643

The CVE-2022-48643 issue in the Linux kernel concerns nf_tables counters underflow when nft_counters_enabled is decremented in the error path of nft_basechain_init during nf_tables_addchain(). Syzbot reported an underflow after adding a chain; the root cause was nf_tables_chain_destroy() decremen...

CVE-2022-48661

CVE-2022-48661 in the Linux kernel relates to the gpio: mockup code where, if software node creation fails, the locally allocated string array isn’t freed, causing a potential resource leakage. The available connected documentation confirms this root cause and states the vulnerability has been re...

CVE-2022-48913

The CVE-2022-48913 issue is a Linux kernel use-after-free in blk_trace (blktrace) allocated when tracing a full disk, where created files under q->debugfs_dir are not removed if bt->dir is NULL, allowing stale pointers (dropped, msg) to be dereferenced. The result is a KASAN-triggered use-a...

CVE-2022-49383

CVE-2022-49383 describes a Linux kernel issue where during restart the watchdog driver for rzg2l_wdt could hit a BUG: Invalid wait context. The fix patches the restart sequence to use clk_prepare_enable() instead of pm_runtime_get_sync() to turn on clocks, addressing the invalid-wait context obse...

CVE-2022-49391

CVE-2022-49391 — Linux kernel remoteproc mtk_scp double free . The issue concerns the removal path for scp->rproc: it is allocated via devm_rproc_alloc(), so an explicit free in the remove function was unnecessary. The vulnerabilities describe a potential double free in the mtk_scp remoteproc ...

CVE-2022-49744

The CVE-2022-49744 entry concerns a Linux kernel mm/uffd issue: when forking, the dst_vma may not inherit VM_UFFD_WP even if the src has it, leading to a stale pte marker and potential access to a corrupted page. The fix is a two‑patch series under “mm: Fixes on pte markers” that hardens pte mark...

CVE-2022-49828

CVE-2022-49828 affects the Linux kernel hugetlbfs: when a HugeTLB page is poisoned, the page was previously truncated from the page cache; the patch keeps the poisoned page in the cache. As described, subsequent reads/mappings can trigger the allocation of a new hugepage instead of signaling pois...

CVE-2022-50048

The CVE-2022-50048 vulnerability concerns the Linux kernel netfilter nf_tables component. The issue is a module reference underflow in the error path when nft_expr_clone() fails: dst->ops is set, but the module refcount hasn’t been bumped yet, so nft_expr_destroy() can underflow. Affected area...

CVE-2022-50192

CVE-2022-50192 : In the Linux kernel, the vulnerability affects the SPI Tegra tegra20-slink path. After calling spi_unregister_master(), the master’s refcount can drop to 0 and the master (and its associated device data) may be freed, causing a use-after-free when using tspi. The fix ensures the ...

CVE-2023-32246

CVE-2023-32246 refers to a race in ksmbd where rcu_barrier() is not invoked during module unload, potentially allowing unloading with pending RCU callbacks and unintended kernel code execution. Multiple sources indicate the vulnerability has been resolved in the Linux kernel; no exploitation deta...

CVE-2023-52909

CVE-2023-52909 affects the Linux kernel NFSD, specifically the nfsd4_open codepath and cached open file handling. The issue arises from a race where a newly created nfsd_file can have its nf_file pointer cleared while hashing, leading to oops if nf_file is NULL, and from a hash-lookup scenario wh...

CVE-2024-37026

CVE-2024-37026 is a Linux kernel vulnerability affecting the DRM/xe path: the GuC context scheduling queue can deadlock when a migration job is queued behind a fault due to shared engines with user jobs. The issue arises because the migrate exec queue could be serviced behind non-reserved BCS ins...

CVE-2024-42112

Summary (CVE-2024-42112): In the Linux kernel, the txgbe driver mishandled isb resource freeing when using MSI/INTx interrupts, risking reads from freed memory. The fix moves wx_free_isb_resources() from txgbe_close() to txgbe_remove() and corrects the isb free action in the txgbe_open() error pa...

CVE-2024-42255

CVE-2024-42255: The Linux kernel contains a fix for a NULL pointer dereference in the TPM HMAC handling path. Specifically, in tpm_buf_check_hmac_response(), the code previously dereferenced auth after NULL checking, which could crash if tpm2_sessions_init() was not called when TCG_TPM2_HMAC was ...

CVE-2024-46704

In the Linux kernel workqueue code, CVE-2024-46704 is a data race fix in __flush_work() when flushing a work item for cancellation. The root cause was reading @work->data before testing from_cancel, which could spuriously trigger KCSAN reports. A patch reorganized the code to test @from_cancel...

CVE-2024-54191

CVE-2024-54191 affects the Linux kernel Bluetooth stack (ISO). The issue arises from a circular lock between the socket lock and hdev lock in the ISO path. The fix reworks iso_sock_recvmsg and related code so that the socket lock is released before acquiring hdev, breaking the circular dependency...

CVE-2025-21752

CVE-2025-21752 (Linux kernel, Btrfs) The issue arises when modifying keys in the RAID stripe-tree using btrfs_set_item_key_safe, which can lead to tree corruption. The root cause of the tree-order issue is not clearly detailed in the provided documents. A practical mitigation suggested in the sou...

CVE-2025-21805

Technical details for CVE-2025-21805 are not disclosed in the provided documents; no affected products, exploit information, or fixes are specified here. Monitor for updates from the referenced sources.

CVE-2025-21954

CVE-2025-21954: Linux kernel netmem component vulnerability where TX of unreadable SKBs could be forwarded, potentially triggering unsafe DMA mappings. The issue arises because stable trees supported netmem RX but not TX, making unreadable RX netmem packets unsafe to forward into the device TX pa...

CVE-2025-37939

CVE-2025-37939 affects the Linux kernel in the libbpf component, specifically the BTF.ext core_relo header handling. The issue arises when btf_ext_parse_info() reads fields of the core_relo header without confirming its presence, potentially triggering a buffer read overflow as reported by OSS-Fu...

CVE-2025-38125

The CVE (CVE-2025-38125) affects the Linux kernel’s net: stmmac driver, where a 0 ptp_rate could propagate to EST configuration, causing a division by zero. The fix adds a guard to ensure ptp_rate is non-zero before configuring EST, with an error path if zero is encountered. According to SUSE/Ope...

CVE-2025-38330

CVE-2025-38330 affects the Linux kernel, specifically a KUnit test path in firmware: cs_dsp_ctl_cache_init_multiple_offsets that could trigger an out-of-bounds read. root cause: mock_coeff_template.length_bytes used for register value allocations, later overridden to 8 bytes, causing incorrect te...

CVE-2025-38563

CVE-2025-38563 affects the Linux kernel perf subsystem. The issue arises when perf mmap-based mappings can be split (VMA split) after initial mapping, causing mismatched offsets/sizes and leaking reference counts for ringbuffer/auxiliary buffers. The fix adds vm_operations_struct.may_split() and ...

CVE-2026-31716

The CVE-2026-31716 entry covers a Linux kernel NTFS3 flaw in journal replay. Description from multiple sources states that check_file_record() validates rec->total against the record size but not rec->used. The journal-replay handlers read rec->used from disk and use it to compute memmov...

CVE-2026-31787

CVE-2026-31787 affects the Linux kernel, specifically the xen/privcmd mapping flow. The root cause is a double-free in the VMA splitting path when userspace performs partial munmap() on a privcmd mapping. Because privcmd_vm_ops defines .close but not .may_split or .open, the kernel may_split() pe...

CVE-2026-45972

The CVE-2026-45972 issue affects the Linux kernel SMB client, specifically smb2_open_file(), where improper handling could lead to memory corruption (UAF) or a double free during SMB2_open() retries. The fixed description states that zeroing err_iov and err_buftype before retrying SMB2_open() pre...

CVE-2026-53016

Summary of CVE-2026-53016 (Linux kernel): The vulnerability exists in the crypto CCP driver when handling AF_ALG rfc3686-ctr-aes-ccp requests. The function ccp_aes_complete() restores AES_BLOCK_SIZE bytes into the caller’s IV buffer, but RFC3686 skciphers expose an 8-byte IV, leading to a buffer ...

CVE-1999-0074

CVE-1999-0074 describes a flaw where listening TCP ports are assigned sequentially, enabling spoofing. The connected documents do not specify affected products, versions, or root cause details beyond this mechanism. Exploitation status, impact scope, and fixes are not provided; some entries reite...

CVE-2001-1391

CVE-2001-1391 is an off-by-one vulnerability in the CPIA driver of the Linux kernel prior to 2.2.19 that allows a local user to write into kernel memory. The issue is documented in multiple advisories (Mandrake MDKSA-2001:037, Debian DSA-047-1) and is described as a problem in the CPIA driver’s b...

CVE-2003-0476

CVE-2003-0476 affects the Linux kernel 2.4.x execve system call, where the executable’s file descriptor is recorded in the caller’s file table, enabling local users to read restricted file descriptors. Public advisories (e.g., Debian DSA-423-1, RHSA-2003:408) note this vulnerability and recommend...

CVE-2003-1040

CVE-2003-1040 concerns kmod in the Linux kernel failing to set its uid, suid, gid, and sgid to 0. This can enable a local attacker to cause a denial-of-service condition (kernel crash) by sending certain signals to kmod. The associated public material confirms the issue in the kernel around 2.4.x...

CVE-2004-0816

CVE-2004-0816: Integer underflow in the Linux kernel’s iptables firewall logging rules prior to 2.6.8 can allow a remote attacker to crash the system via a malformed IP packet. Multiple sources (Mandrake MDKSA-2005:022, SUSE advisory, NVD, Exploit-DB/Seebug pages) confirm the vulnerability exists...

CVE-2005-1263

CVE-2005-1263 affects the Linux kernel: the elf_core_dump path in binfmt_elf.c can trigger a negative length in create_elf_tables, causing a buffer overflow that enables local attackers to execute arbitrary code. Affected: Linux kernel 2.x up to listed pre-release/rc versions across multiple line...

CVE-2005-2500

CVE-2005-2500: A buffer overflow in the Linux kernel 2.6.12 code path (xdr_xcode_array2 in xdr.c) used by SuSE Linux Enterprise Server 9 can be triggered by crafted XDR data for the nfsacl protocol, potentially allowing remote denial of service and possibly arbitrary code execution. The vulnerabi...