CVE-2026-46291

CVE-2026-46291 affects the Linux kernel crypto caam path, specifically hash_digest_key, where HMAC key bytes could be exposed via hex dumps when dynamic debugging is enabled. The reported fix changes the dumping approach to use print_hex_dump_devel() to avoid leaking sensitive HMAC key material a...

CVE-2026-53363

CVE-2026-53363 (Linux kernel xfrm/iptfs): The vulnerability arises because iptfs_consume_frags() does not propagate the SKBFL_SHARED_FRAG flag when transferring paged fragments, mirroring the flaw fixed in skb_try_coalesce() for CVE-2026-46300. As a result, ESP could make incorrect in-place encry...

CVE-1999-0216

The CVE-1999-0216 entry concerns a Denial of Service of inetd on Linux triggered by SYN and RST packets. Connected documents consistently describe inetd on Linux as the affected component and the root cause as crafted TCP packets causing denial of service. Public details in the PT-1997-1097 entry...

CVE-2001-1572

CVE-2001-1572 affects the Linux kernel Netfilter MAC module (versions 2.4.1–2.4.11) and allows remote attackers to bypass MAC-based packet filters by sending small packets. This is a network-vector, low-complexity, no-authentication exploit with partial impacts on confidentiality , integrity , an...

CVE-2003-0465

The CVE-2003-0465 issue affects the Linux kernel (2.4/2.5) where strncpy does not pad with null bytes on architectures other than x86, potentially allowing information leaks. Red Hat’s RHSA-2004:188 and related advisories document this as a kernel vulnerability with fixes in updated kernel packag...

CVE-2003-0501

The CVE-2003-0501 issue concerns the Linux /proc filesystem allowing a local attacker to read sensitive information by opening entries in /proc/self before a setuid program runs, potentially preventing proper ownership/permission changes. Connected advisories confirm this can be triggered in Linu...

CVE-2004-1144

Summary: CVE-2004-1144: A local privilege escalation in the Linux 2.4 AMD64 32‑bit emulation code was identified (Petr Vandrovec). The issue affects the AMD64 path in the 2.4 kernel, allowing a local attacker to gain privileges. Affected context (from connected sources): Red Hat and SUSE advisori...

CVE-2005-0400

The CVE-2005-0400 issue affects the Linux kernel ext2 file system: ext2_make_empty does not initialize memory when allocating a new directory entry block, enabling local users to read potentially sensitive data from the block. The documented fix is in kernel update 2.6.11.6 (and related Red Hat/U...

CVE-2005-2457

CVE-2005-2457 affects the Linux kernel zisofs driver for compressed ISO files. The vulnerability in the driver in older kernels (before 2.6.12.5) allows local users and remote attackers to trigger a denial of service (kernel crash) by crafting a compressed ISO filesystem. The issue is confirmed a...

CVE-2005-2873

Technical details for CVE-2005-2873 are not provided in the connected documents. Available sources reference related CVEs and kernel updates but do not specify affected product/version, root cause, or remediation for this CVE.

CVE-2005-3179

CVE-2005-3179 affects the Linux kernel, specifically the drm.c path in kernel versions 2.6.10 through 2.6.13. The vulnerability arises because a debug file is created in sysfs with world‑readable and world‑writable permissions. This allows a local user to enable DRM debugging and potentially obta...

CVE-2005-3848

CVE-2005-3848 concerns a memory leak in the Linux kernel’s icmp_push_reply() that can be triggered by crafting a large number of ICMP packets, causing memory consumption and a denial of service. Public details in the initial entry specify Linux kernels before 2.6.12.6 and 2.6.13 are affected, wit...

CVE-2006-0456

CVE-2006-0456 affects the Linux kernel prior to 2.6.16 on IBM S/390, where strnlen_user can return an incorrect value. This can enable local users to cause a denial of service via unknown vectors. Connected sources confirm the issue and reference the IBM S/390/strnlen_user function, with remediat...

CVE-2006-1242

CVE-2006-1242 affects the Linux kernel (2.4.x and 2.6.x up to before 2.6.16). The ip_push_pending_frames function increments the IP ID when sending a RST after unsolicited TCP SYN-ACKs, enabling remote Idle-Scan (nmap -sI) bypassing certain protections. Affected versions: Linux 2.4.x and 2.6.x be...

CVE-2006-5749

The CVE-2006-5749 issue affects the Linux kernel 2.4 series up to, but not including, 2.4.34-rc4. It concerns the isdn_ppp_ccp_reset_alloc_state function in drivers/isdn/isdn_ppp.c, which does not call init_timer for the ISDN PPP CCP reset state timer. The underlying cause is a timer initializati...

CVE-2006-6535

CVE-2006-6535 affects the Linux kernel 2.6 series, where a flaw in the dev_queue_xmit() error handling path in the network subsystem can lead to data corruption. Multiple advisories and scanners (e.g., Debian DSA-1304-1, Red Hat/CentOS RHSA-2007:0014, OpenVAS entries) map this to a local data cor...

CVE-2011-4916

CVE-2011-4916 affects the Linux kernel up to version 3.1, where local users could access /dev/pts/ and /dev/tty* to obtain sensitive keystroke information. The available connected sources (OSV/DEBIAN/NVD-style entries) confirm the local-priority impact but do not provide specific patch versions o...

CVE-2014-2739

The CVE-2014-2739 issue affects Linux kernel 3.14.x–3.14.1, specifically the cma_req_handler in drivers/infiniband/core/cma.c. The root cause is an incorrect pointer dereference when resolving a RoCE address already resolved in a different module, which can lead to a denial of service via crafted...

CVE-2016-8417

CVE-2016-8417 describes an elevation-of-privilege vulnerability in the Qualcomm camera driver on Android. The issue could let a local malicious application execute arbitrary code in the kernel context by exploiting the Qualcomm camera driver (in Android kernel versions 3.10 and 3.18). The vulnera...

CVE-2017-0430

CVE-2017-0430 affects Android, involving an elevation of privilege in the Broadcom Wi‑Fi driver that could allow a local malicious application to execute arbitrary code in the kernel context. Affected components are Android kernels 3.10 and 3.18 with Broadcom Wi‑Fi driver involvement; the issue i...

CVE-2017-0446

CVE-2017-0446: Elevation of privilege in the HTC touchscreen driver on Android kernel 3.18, allowing a local attacker to execute arbitrary code in kernel context. Exploitation requires compromising a privileged process and local access. Publicly available patch/fix details are not provided in the...

CVE-2017-0571

CVE-2017-0571 stems from Broadcom’s Wi‑Fi driver (bcmdhd) on Android. A WLFC TLV parity parsing path fails to validate length fields, allowing an attacker controlling the dongle to craft a TLV with a large length (e.g., 255) which overflows a stack buffer, enabling local code execution in the ker...

CVE-2017-0579

CVE-2017-0579 is a local elevation-of-privilege issue in the Qualcomm Video driver on Android, enabling a local malicious app to execute arbitrary kernel code. Affected: Android kernel 3.10 and 3.18; root cause: Qualcomm video driver elevation of privilege. Exploitation status is not detailed in ...

CVE-2021-47568

CVE-2021-47568 concerns the ksmbd module in the Linux kernel, where a memory leak in get_file_stream_info() (fs/ksmbd/smb2pdu.c) could lead to resource exhaustion and a denial-of-service risk. The issue is resolved in the provided documents by applying a fix for the memleak; exploitation details ...

CVE-2022-48764

CVE-2022-48764 concerns the Linux kernel KVM x86 CPUID handling. The provided documents consistently describe a memory-leak issue where the kernel did not free the kvm_cpuid_entry2 array after successful post-KVM_RUN KVM_SET_CPUID{,2} calls, potentially leaving an unreferenced 2048-byte object (e...

CVE-2022-48820

CVE-2022-48820: In the Linux kernel, a refcount leak was fixed in the stm32 USB PHY PLL enable path. The bug affected the stm32_usbphyc_pll_enable() error path where usbphyc->n_pll_cons.counter was not decremented, potentially leaking a reference. The provided connected documents confirm the f...

CVE-2022-48874

The CVE-2022-48874 issue is in the Linux kernel fastrpc subsystem. The description specifies a race condition between fastrpc_map_lookup() unlocking a mutex and the reference count increment in fastrpc_map_find() via fastrpc_map_get(), which can lead to use-after-free. The proposed fix merges fas...

CVE-2022-49030

The CVE-2022-49030 issue affects the Linux kernel component libbpf, specifically a size overflow in ringbuf mmap when mapping producer and data pages. The root cause is an overflow of the 32-bit read/write region size (max 2GB ringbuf on x86-64) due to computing 2 * max_entries, which can overflo...

CVE-2022-49068

CVE-2022-49068 — Summary (Linux kernel, btrfs) The issue occurs in btrfs direct IO write path: during get_blocks_direct_write(), temporary delalloc extents are reserved and later released with btrfs_delalloc_release_extents(). If the length is modified in the COW path, fewer extents may be releas...

CVE-2022-49456

CVE-2022-49456 concerns the Linux kernel bonding driver, where the function bond_ethtool_get_ts_info() could be invoked under a context that did not hold the RCU lock due to removing the rcu_read_lock, and the call path could occur via setsockopt. The provided documents describe the root cause as...

CVE-2022-49867

CVE-2022-49867 : In the Linux kernel IOSM driver (net: wwan: iosm), the device was registered without setting needs_free_netdev and free_netdev() was not called on unregister, causing a memory leak. The published patch enables needs_free_netdev to true at registration, so the netdev subsystem wil...

CVE-2022-49894

CVE-2022-49894 affects the Linux kernel cxl region handling: PATCH fixes region HPA ordering validation to skip regions without address space, preventing a NULL pointer dereference and kernel crash in store_targetN() path (drivers/cxl/core/region.c). Descriptions show the crash trace and affected...

CVE-2023-20845

CVE-2023-20845 affects imgsys. The vulnerability is an out-of-bounds read caused by missing valid range checking, leading to local information disclosure with system execution privileges required and user interaction for exploitation. Patch ID ALPS07197795 / Issue ID ALPS07340357 is associated wi...

CVE-2023-52704

The CVE-2023-52704 issue concerns the Linux kernel component freezer,umbh (kernel/umh.c). A regression from the commit f5d39b020809 in freezer/sched rewrite caused call_usermode_helper_exec() to malfunction for the KILLABLE case because a second unconditional wait_for_completion() was not optiona...

CVE-2023-52706

The CVE-2023-52706 issue affects the Linux kernel gpio-sim, where an inverted logic in gpio_sim_remove_hogs() prevented freeing GPIO hog structures, causing a memory leak. A fix was applied in the kernel to correct the logic and free the hog structures, mitigating the leak. The vulnerability was ...

CVE-2023-52980

The CVE-2023-52980 issue affects the Linux kernel ublk driver, specifically the SPDK ublk target when assigning very large queue depths. The root cause is that UBLK_MAX_QUEUE_DEPTH is 4096, and the calculation sizeof(struct ublk_queue) + depth * sizeof(struct ublk_io) can exceed 65535 when depth ...

CVE-2023-53004

CVE-2023-53004 concerns a Linux kernel overlay (ovl) tmpfile leak due to a missed error cleanup. The vulnerability is resolved in the kernel with patches referenced by the stable commits listed in the sources. The CVSSv3.1 vector indicates LOCAL attack vector, LOW attack complexity and privileges...

CVE-2023-53012

CVE-2023-53012 is documented across multiple connected advisories as a Linux kernel vulnerability affecting the thermal subsystem. The issue arises from calling put_device() before a successful device_register(), specifically in __thermal_cooling_device_register(), and is accompanied by unnecessa...

CVE-2024-43822

CVE-2024-43822 is a Linux kernel vulnerability affecting the ASoc PCM6240 path, where a failed devm_kzalloc() in pcmdevice_i2c_probe() previously allowed a pcmdevice_remove() with a null pointer, risking dereference. The root cause is returning the wrong error path after an allocation failure, wh...

CVE-2024-43848

CVE-2024-43848 pertains to the Linux kernel, addressing a bug in the wifi: mac80211 component during TTLM teardown where the worker may compute a wrong sdata pointer, leading to a crash if executed. The vulnerability is fixed in the kernel; referenced commits in stable kernel trees show the corre...

CVE-2024-46684

CVE-2024-46684 : In the Linux kernel, the binfmt_elf_fdpic path is affected. The vulnerability stems from an incorrect AUXV size calculation in create_elf_fdpic_tables() when ELF_HWCAP2 is defined, which could result in the last AUXV entry being zero and trigger a kernel BUG. The fix adds one to ...

CVE-2024-46690

The CVE-2024-46690 entry documents a Linux kernel issue in nfsd4_deleg_getattr_conflict when a third‑party lease manager is present. The vulnerability stemmed from unsafe dereference of fl->c.flc_owner without verifying fl->fl_lmops, causing incorrect handling of nfsd4_deleg_getattr_conflic...

CVE-2025-21771

CVE-2025-21771 affects the Linux kernel sched_ext subsystem. It stems from incorrect autogroup migration detection in the cgroup/migration path where scx_move_task() could misclassify a non-root cgroup migration as autogroup root migration, triggering a warning. The fix changes the call path by a...

CVE-2025-21840

CVE-2025-21840 affects the Linux kernel thermal netlink interface. The intel-lpmd tool segfaults because THERMAL_GENL_ATTR_CPU_CAPABILITY’s raw value changed in a commit, while intel_lpmd still used the old value. The documented fix moves THERMAL_GENL_ATTR_TZ_PREV_TEMP to the end of enum thermal_...

CVE-2025-21897

CVE-2025-21897: Linux kernel sched_ext vulnerability where pick_task_scx() could return non-queued tasks if balance() wasn’t called. The fix adds a workaround to emulate SCX_RQ_BAL_KEEP only when preceding balance_scx() is missing, and corrects the prior test that used @prev to decide if a task w...

CVE-2025-38028

The vulnerability CVE-2025-38028 affects the Linux kernel’s NFS/localio path (nfs_local_open_fh) due to a race condition involved when dropping the cl_uuid.lock. After the lock is released, another CPU could reclaim the just-added nfsd_file, risking use-after-free scenarios. The described fix is ...

CVE-2025-38560

CVE-2025-38560 concerns x86/sev SNP memory validation in the Linux kernel. The issue arises from how memory validation after a page state change to private handles cache eviction; a mitigation requires touching the first and last byte of each 4K page during validation when COHERENCY_SFW_NO is not...

CVE-2025-38644

CVE-2025-38644 is a Linux kernel issue in the MAC80211 Wi‑Fi code. When a station not yet associated sent NL80211_TDLS_ENABLE_LINK, TDLS was processed before association, leaving sdata->u.mgd.tdls_peer uninitialized and triggering a WARN_ON() in code paths that expected a valid TDLS peer. The ...

CVE-2025-38671

CVE-2025-38671 affects the Linux kernel i2c: qup driver. Root cause: timeout handling only set a return value and did not exit the loop when a client keeps the bus active, enabling kernel hang (observed with PCA953x GPIO extender). Fix: change the logic to return via -ETIMEDOUT, jumping out of th...

CVE-2025-39702

CVE-2025-39702 is a Linux kernel issue where ipv6: sr: Fix MAC comparison to be constant-time addresses timing-attack risk. Connected documents confirm kernels across multiple distributions (e.g., kernel6.12 line for Amazon Linux ALAS, Debian LTS DLA, Astralinux, Mariner/CBL) are affected in vers...