CVE-2006-0482

CVE-2006-0482 affects Linux kernel 2.6.x on SPARC; get_compat_timespec() sanitization is insufficient, enabling local denial of service (hang) via date -s. Debian DSAs document a fix in kernel-source-2.6.8 packages (e.g., 2.6.8-16sarge2) and kernel upgrades; systems should upgrade and reboot to m...

CVE-2006-4572

CVE-2006-4572 concerns the Linux kernel’s netfilter ip6_tables. Affects the IPv6 tables implementation in versions prior to 2.6.16.31, allowing remote attackers to bypass security rules: (1) a protocol-disallow rule via a fragment header-adjacent protocol header, and (2) a header-extension rule v...

CVE-2006-5173

CVE-2006-5173 concerns the Linux kernel: local users can trigger a denial-of-service by mismanaging EFLAGS during context switches and thread creation (Alignment Check flag 0x40000), causing SIGBUS in other processes with unaligned accesses. Multiple connected sources confirm the issue and refere...

CVE-2006-7051

The CVE-2006-7051 vulnerability concerns the Linux kernel 2.6.x, specifically the sys_timer_create function in posix-timers.c. Local users can create a large number of posix timers, which are allocated in kernel memory but not counted as part of the process’s memory, leading to memory exhaustion ...

CVE-2013-1828

The CVE-2013-1828 issue affects the Linux kernel prior to 3.8.4, where sctp_getsockopt_assoc_stats in net/sctp/socket.c does not validate the requested size before a copy_from_user, enabling local privilege escalation via SCTP_GET_ASSOC_STATS getsockopt. Affected are kernel versions before 3.8.4;...

CVE-2013-1956

The CVE-2013-1956 issue affects the Linux kernel prior to 3.8.6, where create_user_ns in kernel/user_namespace.c may bypass filesystem restrictions by not verifying that a chroot directory differs from the namespace root during a crafted clone system call. This violation could allow local users t...

CVE-2014-0102

CVE-2014-0102 affects the Linux kernel up to version 3.13.6. The vulnerability is in the function keyring_detect_cycle_iterator (security/keys/keyring.c), which does not correctly determine whether keyrings are identical. This can allow local users to cause a denial of service (OOPS) by issuing c...

CVE-2015-4176

CVE-2015-4176 affects the Linux kernel up to 4.0.2, where fs/namespace.c mishandles mount connectivity in the context of user namespaces. This allows a local attacker to read arbitrary files by leveraging user-namespace root access during deletion of a file or directory. The vulnerability is docu...

CVE-2016-10153

The CVE-2016-10153 issue affects the Linux kernel 4.9.x before 4.9.6, where the crypto scatterlist API interacts incorrectly with CONFIG_VMAP_STACK, enabling local attackers to cause a denial of service (system crash or memory corruption) or potentially other impacts due to reliance on earlier ne...

CVE-2016-6789

CVE-2016-6789 is an elevation-of-privilege in the NVIDIA libomx library (LIBNVOMX.SO) that could allow a local attacker to execute arbitrary code with privileged process rights. Affected environment is Android (kernel 3.18) using NVIDIA components. The vulnerability is scored as CVSS v3.0 base 9....

CVE-2016-9120

CVE-2016-9120 affects the Linux kernel’s Ion framework: a race condition in ion_ioctl (ion.c) before 4.6 allows local privilege escalation or DoS when ION_IOC_FREE is invoked concurrently on two CPUs. Root cause is a race in the ion_ioctl path. Impact per documents is high (privilege gain/DoS). R...

CVE-2017-0403

CVE-2017-0403 is an elevation-of-privilege vulnerability in the Android kernel performance subsystem. The issue could allow a local malicious application to execute arbitrary code within the kernel context, requiring initial access via a privileged process. Affected software is Android’s kernel w...

CVE-2017-0433

CVE-2017-0433 is an elevation-of-privilege flaw in the Synaptics touchscreen driver for Android, tied to the Kernel-3.10 platform. The vulnerability could allow a local, privileged attacker to execute arbitrary code within the touchscreen chipset context. Several connected sources (including NVD ...

CVE-2017-0456

CVE-2017-0456 describes an elevation-of-privilege flaw in the Qualcomm IPA driver that allows a local attacker to run code in the kernel context on Android. Affected components/versions include Android kernel 3.10 and 3.18 with the issue stemming from the IPA driver in Qualcomm silicon. The vulne...

CVE-2017-0527

CVE-2017-0527 describes an elevation-of-privilege vulnerability in the HTC Sensor Hub Driver on Android, enabling a local malicious app to execute arbitrary code in kernel context. Affected products/versions: Android on kernel 3.10 and 3.18. Root cause is operating in the context of the kernel af...

CVE-2017-0584

CVE-2017-0584 is an information-disclosure issue in the Qualcomm Wi‑Fi driver affecting Android. The vulnerability could let a local malicious application access data outside its permissions, requiring compromise of a privileged process. The Initial document cites kernel versions 3.10 and 3.18 an...

CVE-2017-0648

CVE-2017-0648 is a local elevation-of-privilege in the Android kernel FIQ debugger. The issue arises from the FIQ debugger and SysRq access enabling arbitrary kernel code execution when exploited by a local attacker via a compromised device. Technical details in the connected sources show the roo...

CVE-2017-5547

The CVE-2017-5547 issue affects Linux kernel 4.9.x prior to 4.9.6, specifically the drivers/hid/hid-corsair.c path. The root cause is incorrect interaction with CONFIG_VMAP_STACK, enabling a local attacker to trigger a denial of service (system crash) or memory corruption by abusing more than one...

CVE-2021-47129

CVE-2021-47129 relates to Linux kernel netfilter nft_ct: nft_ct_expect_obj_eval() calls nf_ct_ext_add() for confirmed conntrack entries, but nf_ct_ext_add() requires !nf_ct_is_confirmed(), causing skip of extensions on confirmed conntrack. A fix described in connected docs is to add the ct helper...

CVE-2021-47133

CVE-2021-47133 affects Linux kernel; memory leak in the amd_sfh driver (HID: amd_sfh: Fix memory leak in amd_sfh_work) detected by kmemleak. Root cause: unreferenced kmem object in request_list handling; fix implemented as freeing the request_list entry once the processed entry is removed from th...

CVE-2021-47312

The CVE-2021-47312 issue in Linux kernel nf_tables caused a NULL pointer dereference during error handling when flow is NULL (chain flags NFT_CHAIN_HW_OFFLOAD is false). The fix ensures nft_flow_rule_destroy is only called if flow is non-null, preventing the crash in the error path. Connected ven...

CVE-2021-47349

The CVE-2021-47349 issue is a kernel-level deadlock in the mwifiex path: when removing the mwifiex interface or during firmware reset, cfg80211_unregister_wdev() may need to bring down the link, which then attempts to acquire the same wiphy lock already held. The provided traces show the lock/inv...

CVE-2022-48719

CVE-2022-48719 concerns a Linux kernel issue in the neighbor subsystem where an NUD_FAILED entry could trigger an immediate probe due to neigh_event_send behavior when under certain managed state conditions. The root cause involved a potential deadlock path with NTF_MANAGED entries and a chain of...

CVE-2022-48870

CVE-2022-48870 : In the Linux kernel, a null pointer dereference could occur in spk_ttyio_release due to a null-ptr-defer in tty handling, which has been fixed (tty: fix possible null-ptr-defer in spk_ttyio_release). The vulnerability affects kernel code involved with the Speakup Speakup AUDPTR/T...

CVE-2022-48881

CVE-2022-48881 (Linux kernel) affects the Linux kernel in the AMD platform x86 code. The vulnerability arises from a refcount leak in amd_pmc_probe, and a reference taken by pci_get_domain_bus_and_slot() that callers must release with pci_dev_put() after use. The fix adds pci_dev_put() in the err...

CVE-2022-48922

CVE-2022-48922 (Linux kernel, riscv) : Root cause is a NULL pointer dereference when irqsoff latency tracer is enabled because trace_hardirqs_on/off rely on the frame pointer (CALLER_ADDR1). If the frame pointer is repurposed, memory access faults can occur during boot. The issue was mitigated by...

CVE-2022-48964

The CVE-2022-48964 entry concerns a use-after-free in the Linux kernel ravb_rx_gbeth() path. The vulnerability arises when a socket buffer (skb) is freed by napi_gro_receive(), and later dereferenced, leading to potential memory corruption. The connected sources consistently describe this as a fi...

CVE-2022-49048

CVE-2022-49048 : In the Linux kernel, a panic was reported in ip6_forward() when the input interface has no in6 dev, which has been fixed. The description/refs indicate the issue arises during IPv6 forwarding and can trigger a kernel panic; reproduction used tc qdisc commands on vxlan100. The con...

CVE-2022-49553

The CVE-2022-49553 entry is about the Linux kernel NTFS3 filesystem (fs/ntfs3/super.c). The vulnerability arises when the NTFS BOOT sectors_per_clusters field is > 0x80, which is treated as a shift value; if the shift is too large, the code may compute invalid shifts (max NTFS cluster size is ...

CVE-2022-49876

Summary: CVE-2022-49876 is a Linux kernel vulnerability in wifi/mac80211 that causes a general-protection fault when an interface’s status changes during active transmission. The issue stems from accessing sdata->bss after it is set to NULL during ieee80211_runtime_change_iftype/ieee80211_do_s...

CVE-2022-50023

The CVE-2022-50023 issue affects the Linux kernel's DMAengine dw-axi-dmac component. When a channel has no descriptor and an interrupt is raised, the kernel can OOPS. The root cause is not validating the descriptor result; the fix is to check the outcome of vchan_next_desc() in axi_chan_block_xfe...

CVE-2023-20847

CVE-2023-20847 affects MediaTek chips, specifically the imgsys_cmdq component, where a missing valid range check can cause an out-of-bounds read. This vulnerability can lead to local denial of service with SYSTEM privileges required, and exploitation requires user interaction. The known remedy in...

CVE-2023-53115

CVE-2023-53115 refers to a Linux kernel vulnerability affecting the scsi mpi3mr driver, where memory leaks were reported in mpi3mr_init_ioc during IOC reinitialization. The confirmed remediation is a memory-management fix that prevents reallocation when IOC is being reinitialized. Multiple adviso...

CVE-2023-53127

In CVE-2023-53127, the Linux kernel SCSI MPI3MR driver had a leak in the mpi3mr_remove() cleanup path (expander node leak) due to a missing resource cleanup. The fix adds the missing cleanup in .remove(), mitigating an information/resource leak with a Local attack vector and, per the NVD entry, a...

CVE-2024-40952

CVE-2024-40952 affects the Linux kernel ocfs2 path, causing a NULL pointer dereference in ocfs2_journal_dirty() after bdev->bd_super was replaced with b_assoc_map->host->i_sb, when b_assoc_map isn’t initialized. The fix described in the connected documents is to abort the transaction and...

CVE-2024-41026

The CVE-2024-41026 issue affects the Linux kernel’s davinci_mmc driver: transmitted data size was not validated against sg_miter length, allowing a kernel panic when data exceeds sg_miter. The vulnerability is resolved by limiting the number of transmitted bytes to sg_miter->length (sgm->le...

CVE-2024-42235

CVE-2024-42235 affects the Linux kernel on the s390 architecture. The vulnerability arises because functions crst_table_free() and, for consistency, base_crst_free() can be called with a NULL pointer, potentially leading to a NULL-pointer dereference. The issue was resolved by adding explicit NUL...

CVE-2024-46712

The documented CVE-2024-46712 affects the Linux kernel's DRM VMWGFX subsystem: coherent dumb buffers are enabled even when 3D is disabled, causing guest-only content to be retained and wasting guest-host synchronization efforts. The problem arises because coherent surfaces are only meaningful wit...

CVE-2024-58062

CVE-2024-58062: In the Linux kernel, the iwlwifi mvm code was fixed to avoid NULL pointer dereference when iterating over active links of a virtual interface (vif). The root cause was a missing check that the link pointer exists before dereferencing it; the patch adds usage of for_each_vif_active...

CVE-2025-38012

The CVE-2025-38012 issue affects Linux kernel sched_ext: bpf_iter_scx_dsq_new() may leave an uninitialized iterator after an error, causing bpf_iter_scx_dsq_next() to dereference garbage data. The documented fix is to always clear kit->dsq in bpf_iter_scx_dsq_new(), so that next() and destroy(...

CVE-2025-38141

CVE-2025-38141 is a Linux kernel use-after-free vulnerability in the device mapper reporting path. The issue stems from a race around reading md->zone_revalidate_map and the lifetime of zone resources during blk_revalidate_disk_zones() and dm_blk_report_zones() calls, potentially freeing resou...

CVE-2025-38440

CVE-2025-38440 affects the Linux kernel’s mlx5e DIM handling. A race between disabling DIM and in-flight NAPI callbacks that use the dim pointer on RQ/SQ could leave rq->dim/sq->dim NULL, causing a NULL pointer dereference in net_dim(). The remediation implemented is to call synchronize_net...

CVE-2025-38591

CVE-2025-38591 affects the Linux kernel and is resolved by a patch in the BPF verifier. The issue involved a narrowing context access check in BPF, where a program attempted to read a pointer field (offset 169) in __sk_buff (field sk at offset 168). The verifier incorrectly allowed this “narrower...

CVE-2026-23234

CVE-2026-23234 affects the Linux kernel F2FS subsystem. A use-after-free can occur in f2fs_write_end_io() due to a race with kill_f2fs_super freeing sbi before writeback complete, allowing access to freed sbi during page cache/inode cleanup. The published fix relocates the checkpoint thread wakeu...

CVE-2026-31589

The CVE-2026-31589 issue affects the Linux kernel memory management in the mm path related to folio_unmap_invalidate. The vulnerability arises when the system calls free_folio() directly, instead of loading the free_folio function pointer after obtaining a mapping reference or lock, potentially l...

CVE-2026-46174

In CVE-2026-46174, the Linux kernel vulnerability affects x86/CPU/AMD Zen2 by allowing improper isolation of shared resources in the Zen2 op cache, potentially leading to instruction corruption. The issue has been resolved in the Linux kernel, with Debian and Root packaging advisories noting fixe...

CVE-2026-46227

CVE-2026-46227 describes a race in the Linux kernel SCTP SENDALL path. The sctp_sendmsg() loop over ep->asocs caches the next entry in @tmp, then calls sctp_sendmsg_to_asoc() after dropping the socket lock, allowing a second thread to peel off the cached association and migrate it to a new end...

CVE-2026-46291

CVE-2026-46291 affects the Linux kernel crypto caam path, specifically hash_digest_key, where HMAC key bytes could be exposed via hex dumps when dynamic debugging is enabled. The reported fix changes the dumping approach to use print_hex_dump_devel() to avoid leaking sensitive HMAC key material a...

CVE-2026-53363

CVE-2026-53363 (Linux kernel xfrm/iptfs): The vulnerability arises because iptfs_consume_frags() does not propagate the SKBFL_SHARED_FRAG flag when transferring paged fragments, mirroring the flaw fixed in skb_try_coalesce() for CVE-2026-46300. As a result, ESP could make incorrect in-place encry...

CVE-1999-0216

The CVE-1999-0216 entry concerns a Denial of Service of inetd on Linux triggered by SYN and RST packets. Connected documents consistently describe inetd on Linux as the affected component and the root cause as crafted TCP packets causing denial of service. Public details in the PT-1997-1097 entry...