CVE-2026-53006

The CVE-2026-53006 entry concerns a Use-After-Free in the Linux kernel IPv6 path (icmpv6_rcv) caused by caching IPv6 saddr/daddr before pskb_pull(), since skb->head can change. The fix removes temporary variables and ensures access to &ipv6_hdr(skb)->saddr and &ipv6_hdr(skb)->daddr only ...

CVE-2003-0643

CVE-2003-0643 involves an integer signedness error in the Linux Socket Filter (filter.c) in Linux kernels from 2.4.3-pre3 through 2.4.22-pre10, which can cause a crash (denial of service). The vulnerability is documented across multiple sources (NVD/CVE entries, Debian advisory CD/OSV). The initi...

CVE-2005-0937

The CVE-2005-0937 issue is a Linux kernel vulnerability in futex.c (2.6.x) where get_user may be invoked while mmap_sem is held. This can lead to a deadlock in do_page_fault if another thread is executing mmap or related operations, as described in the Linux kernel advisories. Public references (...

CVE-2005-2099

CVE-2005-2099 affects the Linux kernel (pre-2.6.12.5) where a keyring that is not instantiated properly is not destroyed, allowing local users or remote attackers to trigger a kernel oops via a payload in the keyring, leading to a denial of service. The affected code path is in the keyring destru...

CVE-2005-3847

CVE-2005-3847 affects Linux kernel 2.6.11 up to but not including 2.6.13 and 2.6.12.6, allowing local users to cause a deadlock by sending SIGKILL to a real-time thread that is dumping core. SUSE/ Debian OpenVOS references confirm the issue and its remediation. The known fix is in 2.6.12.6 via th...

CVE-2006-0457

CVE-2006-0457 is a race condition in the Linux kernel 2.6.x key-control flow (add_key, request_key, keyctl). The bug allows local users to crash the kernel or read sensitive kernel memory by altering the length of a string argument between the kernel calculating length and copying data into kerne...

CVE-2006-1522

CVE-2006-1522 affects Linux kernel 2.6.16.1 and 2.6.17-rc1 (and possibly earlier). The sys_add_key function in the keyring code may add a key to a user key instead of a keyring, causing an invalid dereference in __keyring_search_one and resulting in a local DoS (OOPS) / kernel crash. The vulnerab...

CVE-2006-1860

CVE-2006-1860 affects the Linux kernel up to and including 2.6.16.15, with the fix released in 2.6.16.16. The issue is in lease_init (fs/locks.c) where a lock could be freed that might not have been allocated on the stack, allowing a local attacker to cause a denial of service (fcntl_setlease loc...

CVE-2008-1675

The CVE-2008-1675 issue affects the Linux kernel 2.6.x up to 2.6.25.1, where the bdx_ioctl_priv function in the tehuti driver (tehuti.c) does not properly validate register-size related information. This can lead to an unspecified impact, with local attack vectors and potential kernel memory acce...

CVE-2009-0024

The CVE-2009-0024 entry concerns the Linux kernel vulnerability in the sys_remap_file_pages function (mm/fremap.c) present in versions prior to 2.6.24.1. The issue arises from the vm_file structure member and related mmap_region and do_munmap paths, allowing local users to cause a denial of servi...

CVE-2011-2493

The CVE-2011-2493 entry affects the Linux kernel, specifically the ext4_fill_super function in fs/ext4/super.c, with vulnerability present in versions prior to 2.6.39. The issue arises from improper initialization of an error-report data structure, enabling local users to cause a denial of servic...

CVE-2013-4127

CVE-2013-4127 is a use-after-free in the Linux kernel's vhost_net_set_backend (drivers/vhost/net.c) up to and including version 3.10.3, enabling local attackers to trigger a denial of service (OOPS and system crash) by powering on a virtual machine. The connected Nessus advisories (Unity Linux se...

CVE-2016-5870

CVE-2016-5870 concerns the msm_ipc_router_close function in net/ipc_router/ipc_router_socket.c within the ipc_router component of the Linux kernel (3.x), as used in Qualcomm QuIC Android contributions for MSM devices. The vulnerability allows a denial of service via a NULL pointer dereference or ...

CVE-2016-6759

CVE-2016-6759 is an elevation of privilege vulnerability in Qualcomm Media Codecs on Android. It could allow a local malicious app to execute arbitrary code within the context of a privileged process. Affected components/conditions: Android devices using Kernel-3.10 or Kernel-3.18 with Qualcomm M...

CVE-2016-8477

CVE-2016-8477 targets the Qualcomm camera driver in Android and is an information disclosure vulnerability. A local malicious application could access data outside its permission level after compromising a privileged process, making this a local, privilege-requiring issue. Affected: Android on Ke...

CVE-2016-8479

CVE-2016-8479 describes an elevation-of-privilege in the Qualcomm GPU driver for Android. The vulnerability could let a local malicious app execute arbitrary code in the kernel context, potentially leading to a permanent device compromise that may require OS reflashing. Affected: Android on kerne...

CVE-2017-0332

CVE-2017-0332 affects the NVIDIA crypto driver in Android kernels (NVIDIA Tegra). The vulnerability arises from a heap-allocated buffer overwrite in the cryptodev path, which could allow a local attacker to execute arbitrary code in kernel context (privilege escalation). Android’s public bulletin...

CVE-2017-0443

CVE-2017-0443 describes an elevation of privilege in the Qualcomm Wi‑Fi driver on Android, allowing a local malicious application to execute arbitrary code in the kernel context. The vulnerability requires compromising a privileged process to gain initial access, and affects Android devices using...

CVE-2017-0445

CVE-2017-0445 is a kernel-privilege elevation in the HTC touchscreen driver affecting Google Pixel/Pixel XL devices (Android kernel 3.18). The connected CNVD entry confirms an HTC touchscreen driver flaw allowing a local malicious app to execute code in kernel context, i.e., a local privilege esc...

CVE-2017-8061

The CVE-2017-8061 issue affects Linux kernels 4.9.x and 4.10.x prior to 4.10.7, where dvb-usb-firmware.c mishandles CONFIG_VMAP_STACK, allowing local users to trigger a denial of service or memory corruption by using more than one virtual page for a DMA scatterlist. Root cause: incorrect interact...

CVE-2021-47271

The CVE-2021-47271 entry concerns a Linux kernel deadlock in usb/cdnsp Thread IRQ handling. The root cause is a mismatch where spin_lock/spin_unlock was used instead of spin_lock_irqsave/spin_lock_irqrestore in cdnsp_thread_irq_handler, leading to potential deadlocks (notably under NCM traffic). ...

CVE-2021-47273

CVE-2021-47273 concerns the Linux kernel component for the usb dwc3-meson-g12a PHY glue. When PHY0 is disabled and only PHY1 is used (e.g., Odroid-HC4), regmap initialization erroneously targets the usb2 path, since PHY1 regmap entry isn’t initialized. This can lead to a kernel NULL pointer deref...

CVE-2021-47278

CVE-2021-47278 : Linux kernel vulnerability in the bus: mhi: pci_generic driver where the remove path used del_timer(), which may not wait for the timer handler to finish, causing a potential use-after-free. The fix is to replace del_timer() with del_timer_sync() to ensure the timer handler has f...

CVE-2021-47570

CVE-2021-47570 is addressed in the Linux kernel staging area (rt8188eu driver). The issue was a memory leak in rtw_wx_read32() where ptmp was not freed before returning -EINVAL. A fix (memory cleanup) has been applied to resolve this vulnerability; references point to kernel stable commits that i...

CVE-2022-48782

In the Linux kernel, CVE-2022-48782 concerns a use-after-free in the MCTP route logic. Specifically, after mctp_key_add() fails, the freed key is later used in trace_mctp_key_acquire(), creating memory-safety issues. A fix is described as adding an else branch to use the key only when mctp_key_ad...

CVE-2022-48871

In CVE-2022-48871, the Linux kernel fix targets tty: serial: qcom-geni-serial slab-out-of-bounds on the RX FIFO buffer. The probe allocates port->rx_fifo using a default depth (e.g., 16); during serial startup, port->rx_fifo_depth is updated to match device capabilities (e.g., 32). The RX U...

CVE-2022-48886

The CVE-2022-48886 issue affects the Linux kernel ice subsystem and is due to not validating kzalloc return, allowing NULL pointer dereference. The fix adds a return-value check for kzalloc and uses a goto-label for cleanup to share code paths. Connected advisories (SUSE/SU-2024:3209-1, SUSE/SU-2...

CVE-2022-49765

CVE-2022-49765 concerns the Linux kernel 9p transport. The issue arises from inconsistent lock state between p9 client structures and the trans_fd transport path. Specifically, p9_req_put() and p9_tag_remove() interactions cross IRQ contexts but the trans_fd path used a different lock, leading to...

CVE-2022-49808

CVE-2022-49808 concerns the Linux kernel net: dsa teardown path where tagger-owned storage could leak on unbind. The provided description explains the root cause: in the dsa switch teardown path, tag_ops->disconnect was not properly dismantled during normal driver teardown, risking use-after-f...

CVE-2022-49866

CVE-2022-49866 concerns a memory‑leak in the Linux kernel’s MHI/wwan path: the MHI driver registered a network device without marking needs_free_netdev, so free_netdev() wasn’t called on unregister. The public sources describe a patch that sets needs_free_netdev to true when registering the netwo...

CVE-2022-50223

CVE-2022-50223 affects the Linux kernel on LoongArch where, when CONFIG_CPUMASK_OFFSTACK and CONFIG_DEBUG_PER_CPU_MAPS are enabled, cpu_max_bits_warn() could trigger a runtime warning during /proc/cpuinfo display. The issue arises from iterating CPUs using NR_CPUS and is fixed by using nr_cpu_ids...

CVE-2023-52987

CVE-2023-52987 affects the Linux kernel ASoC SOF component: ipc4-mtrace code path. The vulnerability arises from an underflow in sof_ipc4_priority_mask_dfs_write() caused by using a signed id that should be unsigned, leading to an array underflow. The available connected documents consistently st...

CVE-2023-53136

CVE-2023-53136 concerns a Linux kernel af_unix memory leak in OOB support. The root cause is that queue_oob() may hold a reference on a pid via maybe_add_creds(), while skb->destructor is not set (directly or via unix_scm_to_skb()), allowing the reference to be leaked when the skb is freed. Sy...

CVE-2024-38609

The CVE-2024-38609 issue is a Linux kernel vulnerability in wifi/mt76 (connac) where a NULL wcid could be dereferenced, leading to a crash. The fixed code adds a validity check before dereferencing the wcid to prevent a NULL pointer dereference. Exploitation would be local, with a crash impact (I...

CVE-2024-46688

CVE-2024-46688 - Linux kernel erofs fix : The issue is an out-of-bound access in erofs when z_erofs_gbuf_growsize() partially fails, potentially causing NULL-pointer dereference or memory leaks if the old gbuf->pages[] array is too small. The documented mitigation is to compare against gbuf-&g...

CVE-2024-46696

The CVE-2024-46696 issue affects the Linux kernel’s NFS daemon (nfsd), specifically the nfsd4_cb_getattr_release path. The root cause is a use-after-free (UAF) risk that arises after dropping a delegation reference; the vulnerable fields can be accessed only if the reference is still considered v...

CVE-2024-46699

CVE-2024-46699: In the Linux kernel, drm/v3d preemption was not disabled around the write_seqcount_begin/end() used to update GPU stats, risking seqcount/RCU race conditions. Root cause: missing __seqprop_assert around the update path in v3d stats code leading to potential data corruption under p...

CVE-2024-46769

CVE-2024-46769 relates to the Linux kernel SPI Intel driver. A check for the pointer returned by devm_kasprintf() in intel_spi_populate_chip() was missing, allowing a NULL pointer to be used for pdata->name. The vulnerability has been resolved in the kernel with the fix described in the linked...

CVE-2024-46837

CVE-2024-46837 affects the Linux kernel component for the DRM panthor uAPI, specifically the group_create path. The vulnerability arose from missing permission checks allowing non-privileged users to create high-priority groups. The underlying fix restricts who can set higher-than-MEDIUM prioriti...

CVE-2024-56668

The CVE-2024-56668 issue affects the Linux kernel iommu/vt-d path where qi_batch could be NULL for nested parent domains, risking a kernel NULL pointer dereference and a potential memory leak due to lack of locking around domain->qi_batch allocation. The root cause is that qi_batch was not all...

CVE-2025-21879

CVE-2025-21879 describes a Linux kernel use-after-free in the btrfs code. In btrfs_scan_root(), the kernel could dereference inode->root->fs_info after scheduling the inode for delayed iput, if the cleaner kthread ran iput first, leading to a use-after-free of the inode and potential crash....

CVE-2025-21932

CVE-2025-21932 – Linux kernel vulnerability (mm: abort vma_modify() on merge out of memory failure) The issue occurs in vma_modify() during a merge attempt that fails due to an out-of-memory error while committing the merge. In this edge case, VM region state (VMG) may be left with corrupted star...

CVE-2025-37941

CVE-2025-37941 affects the Linux kernel ASoC: codecs/wcd937x. The issue is a potential memory leak in wcd937x_soc_codec_probe() when snd_soc_dapm_new_controls() or snd_soc_dapm_add_routes() fail, because the allocated wcd937x->clsh_info is not released. The root cause is missing cleanup in err...

CVE-2025-38041

CVE-2025-38041 concerns Linux kernel code: clk: sunxi-ng: h616 reparents the GPU clock to the GPU1 clock during frequency changes to mitigate panfrost OoOps and GPU hangs when performing device DVFS on the GPU. The vulnerability is effectively a local issue with the GPU clock DVFS pathway; the ex...

CVE-2025-38502

Technical details beyond the initial description are not provided in the connected documents; no explicit product/version, impact specifics, or remediation are present here. Monitor for updates.

CVE-2025-38565

CVE-2025-38565: In the Linux kernel perf_mmap() path, if buffer allocation fails the code still invokes event_mapped(), which can increment perf_rdpmc_allowed on x86 and leaks references because perf_mmap_close() is not called. The documented fix is to return early on failure to prevent the refer...

CVE-2025-38671

CVE-2025-38671 affects the Linux kernel i2c: qup driver. Root cause: timeout handling only set a return value and did not exit the loop when a client keeps the bus active, enabling kernel hang (observed with PCA953x GPIO extender). Fix: change the logic to return via -ETIMEDOUT, jumping out of th...

CVE-2026-23416

The CVE-2026-23416 issue affects the Linux kernel (mm/mseal) where vm_area_struct end handling could become stale during VMA merges. The root cause is curr_end not staying in sync when a VMA is updated via vma_modify_flags(), leading to an incorrect curr_start on the next iteration. The fix uncon...

CVE-2026-31432

CVE-2026-31432 affects the Linux kernel ksmbd component. Affected handling of compound requests (e.g., READ + QUERY_INFO(Security)) could allow an out-of-bounds write when the first READ command consumes most of the response buffer and ksmbd builds a security descriptor. The root cause is that sm...

CVE-2026-43114

Summary: CVE-2026-43114 involves the Linux kernel netfilter nft_set_pipapo_avx2 path. The bug arises when AVX2 matching incorrectly masks and returns a non-matching entry on expiry after a flush, causing a clashing element report. Root-cause: too-early return in AVX2 match functions, leading to o...