CVE-1999-0720

The set of connected records confirms a Linux-specific vulnerability in the pt_chown utility: local attackers can modify TTY terminal devices that belong to other users, indicating a local privilege/permission misuse at the device level. The description across sources is consistent (pt_chown affe...

CVE-2004-0887

CVE-2004-0887 affects SUSE Linux Enterprise Server 9 on the S/390 platform, where the SACF privileged instruction is not handled correctly, allowing a local user to gain root privileges. Connected sources also reference Debian advisories for kernel-source-2.4.27 updates (DSA-1018-1/2) that addres...

CVE-2005-0749

The CVE-2005-0749 issue affects the Linux kernel prior to 2.6.11.6. The vulnerability arises in load_elf_library where freeing an invalid pointer via a crafted ELF library or executable can trigger a kernel crash (DoS). Affected component: kernel’s ELF loading/free path (load_elf_library). The pu...

CVE-2005-0839

CVE-2005-0839 affects the Linux kernel 2.6 family, where access to the N_MOUSE line discipline for TTYs was not restricted. This allowed a local attacker to inject mouse movements or keystrokes into other user sessions, potentially enabling privilege escalation. The issue is fixed in later kernel...

CVE-2005-1765

The CVE-2005-1765 issue is a local denial of service in the Linux kernel on AMD64 when running in 32‑bit compatibility mode, triggered by syscall() with crafted arguments. Public details across connected docs confirm affected software and fixed packages: Debian’s DSA-922-1 (security advisory) lis...

CVE-2005-2500

CVE-2005-2500: A buffer overflow in the Linux kernel 2.6.12 code path (xdr_xcode_array2 in xdr.c) used by SuSE Linux Enterprise Server 9 can be triggered by crafted XDR data for the nfsacl protocol, potentially allowing remote denial of service and possibly arbitrary code execution. The vulnerabi...

CVE-2005-3857

The CVE-2005-3857 entry refers to a vulnerability in the Linux kernel before 2.6.15-rc3 where the time_out_leases function in locks.c can exhaust memory and fill system logs. Local attackers could trigger a denial of service by creating a large number of broken leases, pumping printk log messages...

CVE-2006-0557

CVE-2006-0557 : In the Linux kernel 2.6.x, the sys_mbind path in mempolicy.c failed to sanity-check the maxnod value before computing in get_nodes, enabling a local user to trigger a kernel crash (DoS). Public advisories tie this to local exploitation with kernel crashes, not remote code executio...

CVE-2006-1525

CVE-2006-1525 affects the Linux kernel 2.6 series (before 2.6.16.8). The vulnerability arises in ip_route_input, where a local user can trigger a NULL pointer dereference by requesting a route for a multicast IP address, leading to a denial of service (panic). Public references in Debian/DSA advi...

CVE-2006-2629

CVE-2006-2629 concerns a race condition in the Linux kernel (versions 2.6.15 to 2.6.17) on SMP systems. An attacker with local access can cause a denial of service (kernel crash) by rapidly creating and exiting a large number of tasks, then querying the /proc entry of an exiting task. This leads ...

CVE-2011-2534

CVE-2011-2534 : A buffer overflow in the Linux kernel’s clusterip_proc_write (net/ipv4/netfilter/ipt_CLUSTERIP.c) exists before 2.6.39. A crafted write operation that includes non-terminated string data could allow a local attacker to cause a denial of service and potentially other impact. The ro...

CVE-2012-0810

CVE-2012-0810 affects the Linux kernel up to version prior to 3.3, where the int3 handler uses a per-CPU debug stack and can be abused by a local, unprivileged user to cause stack corruption and a denial of service via crafted lock-contention scenarios. Publicly available connected documents conf...

CVE-2014-4157

CVE-2014-4157 affects the Linux kernel on MIPS up to 3.14.8. The fast system-call path does not configure _TIF_SECCOMP checks, letting local attackers bypass PR_SET_SECCOMP restrictions by running a crafted app without trace/audit. Impact: partial confidentiality, integrity, and availability (loc...

CVE-2014-6417

CVE-2014-6417 affects net/ceph/auth_x.c in Ceph usage within the Linux kernel prior to 3.16.3. The issue arises from not handling kmalloc failure, enabling a remote attacker to cause a denial of service (system crash) or potentially other impact via a long unencrypted auth ticket. Public advisori...

CVE-2016-10907

Vulnerability CVE-2016-10907 affects the Linux kernel in drivers/iio/dac/ad5755.c up to version 4.8.5, with an out-of-bounds write in the function ad5755_parse_dt. Exploitation could lead to memory corruption. The ChangeLog indicates the issue was addressed in kernel 4.8.6 (and later). Controlled...

CVE-2017-0510

CVE-2017-0510 describes an elevation-of-privilege vulnerability in the Android kernel FIQ debugger that could allow a local malicious app to execute code in kernel context. Affected: Android on Kernel-3.10 (Nexus 9 cited). Impact: potential local permanent device compromise requiring OS reflashin...

CVE-2017-8063

The CVE-2017-8063 issue affects Linux kernel 4.9.x and 4.10.x before 4.10.12, where the cxusb.c driver in drivers/media/usb/dvb-usb mishandles interaction with CONFIG_VMAP_STACK, allowing a local user to cause a denial of service (system crash) or other unspecified impact by leveraging more than ...

CVE-2021-47519

The Linux kernel contains a memory leak vulnerability within the CAN device driver specifically in the m_can_read_fifo() function located in the drivers/net/can/m_can/m_can.c module. The root cause is that if the second call to m_can_fifo_read() fails, the function jumps to the out_fail label and...

CVE-2022-48835

CVE-2022-48835 involves a page fault in the Linux kernel driver mpt3sas (SCSI) on a LUN reset path. A faulty invalid reply_q pointer used by mpt3sas_base_sync_reply_irqs leads to a kernel oops when processing reply queues; the described mitigation is to move the _base_process_reply_queue() call i...

CVE-2022-48870

CVE-2022-48870 : In the Linux kernel, a null pointer dereference could occur in spk_ttyio_release due to a null-ptr-defer in tty handling, which has been fixed (tty: fix possible null-ptr-defer in spk_ttyio_release). The vulnerability affects kernel code involved with the Speakup Speakup AUDPTR/T...

CVE-2022-48922

CVE-2022-48922 (Linux kernel, riscv) : Root cause is a NULL pointer dereference when irqsoff latency tracer is enabled because trace_hardirqs_on/off rely on the frame pointer (CALLER_ADDR1). If the frame pointer is repurposed, memory access faults can occur during boot. The issue was mitigated by...

CVE-2022-49048

CVE-2022-49048 : In the Linux kernel, a panic was reported in ip6_forward() when the input interface has no in6 dev, which has been fixed. The description/refs indicate the issue arises during IPv6 forwarding and can trigger a kernel panic; reproduction used tc qdisc commands on vxlan100. The con...

CVE-2022-49876

Summary: CVE-2022-49876 is a Linux kernel vulnerability in wifi/mac80211 that causes a general-protection fault when an interface’s status changes during active transmission. The issue stems from accessing sdata->bss after it is set to NULL during ieee80211_runtime_change_iftype/ieee80211_do_s...

CVE-2022-49950

CVE-2022-49950 affects the Linux kernel: a bug in misc: fastrpc where the probe session-duplication overflow increments the session count even when no sessions are available, allowing memory corruption beyond the fixed-size slab-allocated fastrpc_session array during open(). This was fixed in the...

CVE-2022-50001

The CVE-2022-50001 issue affects the Linux kernel netfilter component nft_tproxy. The root cause was that TPROXY could be used from non-prerouting paths, leading to a null dereference crash. The fix restricts nft_tproxy to the prerouting hook, requiring a check that it runs only in prerouting. Th...

CVE-2022-50052

The CVE-2022-50052 issue affects the Linux kernel ASoC: Intel: avs component. It stems from using snprintf(), which returns the would-be-filled size on buffer overflow, creating a potential buffer overflow; the patch replaces snprintf() with scnprintf() to mitigate this. The vulnerability is trac...

CVE-2022-50080

CVE-2022-50080 (Linux kernel) affects kernel code path for tee/shm handling. The issue is an integer overflow in register_shm_helper() when calculating pages for a memory region supplied by user space, which can lead to a NULL pointer dereference in internal_get_user_pages_fast() via pin_user_pag...

CVE-2022-50108

CVE-2022-50108 affects the Linux kernel via the mfd: max77620 sub-system. The root cause is a refcount leak in max77620_initialise_fps: of_get_child_by_name() returns a node pointer with an incremented refcount, and the patch adds missing of_node_put() to release it when no longer needed. The iss...

CVE-2022-50207

Summary (CVE-2022-50207) : In the Linux kernel, ARM bcm Kona handling had a refcount leak in bcm_kona_smc_init. The root cause: of_find_matching_node() returns a node pointer with an incremented refcount and may not be released. The patch adds a missing of_node_put() to drop the reference when th...

CVE-2023-20715

CVE-2023-20715 affects the wlan component in MediaTek-based devices. The issue is an out-of-bounds write caused by a missing bounds check, enabling local escalation of privileges with SYSTEM execution rights required. Exploitation reportedly does not require user interaction. The vulnerability’s ...

CVE-2023-53115

CVE-2023-53115 refers to a Linux kernel vulnerability affecting the scsi mpi3mr driver, where memory leaks were reported in mpi3mr_init_ioc during IOC reinitialization. The confirmed remediation is a memory-management fix that prevents reallocation when IOC is being reinitialized. Multiple adviso...

CVE-2024-38631

The CVE-2024-38631 entry concerns the Linux kernel vulnerability in iio: adc: PAC1934 where an out-of-bounds array index could affect average current/voltage measurements. The hardware device supports 4 channels, but sysfs exposes additional “fake” channels for averages, which is the root cause. ...

CVE-2024-46704

In the Linux kernel workqueue code, CVE-2024-46704 is a data race fix in __flush_work() when flushing a work item for cancellation. The root cause was reading @work->data before testing from_cancel, which could spuriously trigger KCSAN reports. A patch reorganized the code to test @from_cancel...

CVE-2024-46769

CVE-2024-46769 relates to the Linux kernel SPI Intel driver. A check for the pointer returned by devm_kasprintf() in intel_spi_populate_chip() was missing, allowing a NULL pointer to be used for pdata->name. The vulnerability has been resolved in the kernel with the fix described in the linked...

CVE-2024-58238

CVE-2024-58238 : In the Linux kernel Bluetooth btnxpuart driver, a race around UART break handling and power-save state could cause a TX timeout during long stress tests. Root cause: ps_state read/write and UART break toggling were not synchronized, allowing simultaneous tx_work scheduling and in...

CVE-2025-38140

CVE-2025-38140 concerns a Linux kernel vulnerability in the dm (device-mapper) layer affecting devices with zone write plugs. The issue in dm_revalidate_zones() could cause the device’s zoned settings to diverge from the new table, and if zone write plug resources are present, reading bdev_zone_i...

CVE-2025-38232

CVE-2025-38232 relates to a race in NFSD where nfsd registration and proc exports may collide. The Linux kernel fix addresses a race between creating the /proc/fs/nfsd entry and its removal during module init/exit, which could cause kernel OOPs when exports are updated (exportfs -r) while nfsd is...

CVE-2025-38242

In CVE-2025-38242, Linux kernel mm/userfaultfd: fix race between userfaultfd_move and swap cache. The description documents two race types: a) a BUG_ON when filemap lookup returns NULL and folio is added to the swap cache, and b) a race where a folio is changed after lookup causing RSS counter co...

CVE-2025-38261

CVE-2025-38261 affects the Linux kernel on riscv: the SR_SUM state must be saved/restored across task switches to prevent crashes under heavy load. The issue stems from put_user() in schedule_tail potentially clearing SR_SUM when a sleeping function is involved, risking kernel memory access fault...

CVE-2025-38340

CVE-2025-38340: Linux kernel vulnerability in firmware: cs_dsp causing an OOB memory read in KUnit test due to source string length rounding up to allocation size. Reported by KASAN as out-of-bounds in cs_dsp_mock_bin_add_name_or_info(). Affects kernel components involved in firmware cs_dsp; root...

CVE-2025-38413

The CVE-2025-38413 issue relates to virtio-net: xsk: rx length checking in the Linux kernel. The problem was that buf_to_xdp validated len using xsk_pool_get_rx_frame_size() + vi->hdr_len, but the first buffer for virtio headers can only contain xsk_pool_get_rx_frame_size() bytes. The fix intr...

CVE-2025-38577

CVE-2025-38577 affects the f2fs component of the Linux kernel. A use-after-free in the f2fs inode handling path leads to a KASAN failure observed during inode writeback (f2fs_update_inode/page, f2fs_write_inode) and can trigger a crash when the kernel attempts to delete a list entry in __list_del...

CVE-2025-38590

CVE-2025-38590: In the Linux kernel mlx5e IPsec offload path, if the decrypted xfrm state is not found, the secpath on the skb may remain and be dereferenced by __xfrm_policy_check(), causing a crash. The documented fix explicitly removes the skb secpath when the xfrm state lookup fails after har...

CVE-2025-38684

CVE-2025-38684 affects the Linux kernel’s net/sched ETS implementation. The issue arose from purging unused DRR queues during ets_qdisc_change(), where the code used the new value of q->nbands for cleanup. The fix ensures the purge uses the old values of q->nbands (and q->nstrict), so pu...

CVE-2025-38704

CVE-2025-38704: In the Linux kernel, a bug in rcu/nocb could access an invalid nocb_cb_kthread pointer during CPU online/offline cycles. The fix changes the safety check to use rdp->nocb_gp_kthread instead of rdp_gp->nocb_gp_kthread. Public advisories from SUSE (SUSE-SU-2026:20220-1, openSU...

CVE-2026-23099

CVE-2026-23099 (bonding: limit BOND_MODE_8023AD to Ethernet devices) is addressed in the Linux kernel, preventing use of BOND_MODE_8023AD on non-Ethernet devices. The issue, observed in bonding/low-level MAC address handling, can cause out-of-bounds memory access when enslaving or configuring net...

CVE-2026-31488

The CVE-2026-31488 entry concerns a Linux kernel issue in the DRM/AMD display path where DSC (display stream compression) validation could drop the mode_changed flag for an unrelated mode change within the same KMS commit. This could cause new streams to be created for DSC-independent CRTCs, whil...

CVE-2026-31717

In the Linux kernel ksmbd, a vulnerability allows an authenticated user to hijack an orphaned durable handle by reconnecting with a different security context. The issue stems from ksmbd not verifying that the requester’s SecurityContext matches the original opener when a durable handle is reconn...

CVE-2026-43049

CVE-2026-43049 affects the Linux kernel HID logitech-hidpp driver (Logitech G920 force feedback). If force feedback init fails, resources may be torn down inconsistently, enabling a use-after-free (UAF) if userspace still references dangling objects. The fixed approach chose to warn but return su...

CVE-2026-43071

CVE-2026-43071 affects the Linux kernel dcache component, specifically an OOB read in dentry_hashtable when dhash_entries is set to 1. The root cause is incorrect d_hash_shift calculation, causing an access to unallocated memory and potential kernel panic/DoS. The issue is mitigated by patching t...