CVE-2025-38670

CVE-2025-38670 affects ARM64 Linux kernel. The vulnerability arises in cpu_switch_to() and call_on_irq_stack() where masking and saving the DAIF state and SCS pointers are not atomic across stack switches, allowing a race during task/IRQ stack transitions. Interrupts (SErrors/Debug Exceptions) ca...

CVE-2025-38549

Technical details about CVE-2025-38549 (affected components, root cause, impact, and remediation) are not provided in the supplied documents; monitor for updates.

CVE-2025-38571

CVE-2025-38571 is a Linux kernel vulnerability affecting sunrpc/NFS over TLS. The issue arises from the client-side handling of TLS alerts in tls_alert_recv, caused by an assumption that the msghdr iterator’s kvec contains valid data. The patch reworks how control messages are set up and used by ...

CVE-2025-38685

CVE-2025-38685 affects the Linux kernel fbdev path. The issue arises in vmalloc out-of-bounds write within fast_imageblit when a userspace ioctl (FBIOPUT_CON2FBMAP) maps a console to a framebuffer; if the console resize during mapping fails but the code continues, it can end up updating display s...

CVE-2026-23060

The CVE-2026-23060 issue in the Linux kernel crypto: authencesn module arises when assoclen

CVE-2026-23466

The CVE-2026-23466 vulnerability affects the Linux kernel’s drm/xe component, where GGTT MMIO access was only protected by hotplug mechanics (drm_dev_enter). If a driver fails to load or during teardown when BOs may be freed asynchronously, drm_dev_unplug() may not be invoked and the MMIO region ...

CVE-2026-43116

The CVE-2026-43116 issue affects the Linux kernel’s netfilter ctnetlink master conntrack handling. The root cause is insufficient locking around the master conntrack object, which can become invalid while still referenced (exp->master). The fix extends the nf_conntrack_expect_lock and the spin...

CVE-2026-45999

The CVE-2026-45999 issue affects the Linux kernel EROFS LZ4 inplace decompression path (z_erofs_lz4_handle_overlap). Crafted extents can trigger an unsigned underflow (outpages

CVE-2026-46122

Summary : CVE-2026-46122 concerns the Linux kernel wifi driver (b43) where firmware-provided key indices can exceed the bounds of dev->key[] (58 entries) in b43_rx(), allowing an out-of-bounds read. The fix makes the B43_WARN_ON check enforcing and drops the frame when an invalid key index is ...

CVE-2026-46149

Summary: CVE-2026-46149 affects the Linux kernel SCSI target subsystem, specifically the configfs path in tg_pt_gp_members_show(). The function formats LUN paths with snprintf() into a 256-byte stack buffer and then copies cur_len bytes via memcpy(), but snprintf() may return a length that exceed...

CVE-2026-46159

The CVE-2026-46159 issue affects the Linux kernel’s Btrfs code, specifically btrfs_ioctl_space_info(). A TOCTOU race occurs between two passes over block group RAID type lists: the first pass counts entries for allocation, the second fills the buffer and releases the groups_sem lock. If entries s...

CVE-2026-46206

The CVE-2026-46206 issue affects the Linux kernel’s batman-adv implementation, where the tp_meter component could start new sender or receiver sessions after mesh_state had exited BATADV_MESH_ACTIVE during teardown. The vulnerability stems from improper state management in batman-adv/tp_meter, po...

CVE-2026-46312

CVE-2026-46312 is a Linux kernel vulnerability involving media: videobuf2 where vb2_dma_sg_mmap did not set the VMA flags, potentially triggering a WARN_ON in drm_gem_mmap_obj() during mmap() of an imported dma-buf. The fix adds proper VMA flag handling in vb2_dma_sg_mmap_mmap (consistent with vb...

CVE-2026-53243

CVE-2026-53243 affects the Linux kernel component related to RSEQ (rseq_exit_user_update). The issue is an uninitialized stack variable used in the initialization of the struct rseq_ids, where ids.node_id is derived from ids.cpu_id before it is initialized, enabling potential information leakage....

CVE-2026-53254

The CVE-2026-53254 issue affects the Linux kernel Bluetooth RFCOMM MCC handlers, which cast skb data to protocol-specific structs without validating skb->len. A malicious remote device could send truncated MCC frames, causing out-of-bounds reads. The fix is to validate and access required data...

CVE-2026-64257

CVE-2026-64257 affects the Linux kernel SMB2 client logic. The issue arose from overlap handling in __smb2_calc_size(), where clearing data_length could cause an invalid SMB2 response to appear as if it has no data area, allowing an unintended length-exemption path. The fix tracks data area overl...

CVE-2004-0138

CVE-2004-0138 affects the Linux kernel 2.4 series prior to 2.4.25. The vulnerability lies in the ELF loader: a crafted ELF with an invalid interpreter arch triggers a BUG() when an invalid VMA is unmapped, allowing local denial of service (crash). The issue is mitigated by upgrading to 2.4.25 or ...

CVE-2004-0816

CVE-2004-0816: Integer underflow in the Linux kernel’s iptables firewall logging rules prior to 2.6.8 can allow a remote attacker to crash the system via a malformed IP packet. Multiple sources (Mandrake MDKSA-2005:022, SUSE advisory, NVD, Exploit-DB/Seebug pages) confirm the vulnerability exists...

CVE-2005-0530

CVE-2005-0530 is a signedness error in the copy_from_read_buf function in n_tty.c of the Linux kernel (affected: 2.6.10 and 2.6.11rc1) that allows local users to read kernel memory via a negative argument. The vulnerability is documented across multiple advisories, including Red Hat (RHSA-2005:36...

CVE-2005-3858

Technical details about CVE-2005-3858 are not publicly available in the provided connected documents. Monitor for updates.

CVE-2005-4881

CVE-2005-4881 is a Linux kernel netlink padding init flaw affecting 2.4.x (pre-2.4.37.6) and 2.6.x (pre-2.6.13-rc1). The issue left padding fields uninitialized in netlink-related structures (e.g., tc_fill_qdisc, tcf_fill_node, inet6_fill_ifinfo, __nlmsg_put, __rta_reserve, etc.), enabling local ...

CVE-2006-2445

CVE-2006-2445 is a race-condition bug in Linux kernels prior to 2.6.16.21 affecting run_posix_cpu_timers. A local attacker can trigger a denial-of-service (BUG_ON crash) by attaching a timer to a process that is exiting on a single CPU. The connected SUSE/Ubuntu/Mandriva advisories describe the s...

CVE-2006-4813

Concrete details found: CVE-2006-4813 affects the Linux kernel 2.6.x prior to 2.6.13, where __block_prepare_write in fs/buffer.c fails to clear buffers under certain error conditions, allowing a local user to read portions of files that have been unlinked. Impact is partial confidentiality; explo...

CVE-2006-6060

CVE-2006-6060 affects the Linux kernel 2.6.x family (notably up to 2.6.18) where a malformed NTFS file stream can trigger an infinite loop in __find_get_block_slow, causing local CPU exhaustion (DoS). Connected sources confirm this CVE is listed across Debian, SUSE/openSUSE advisories and kernel ...

CVE-2007-3513

CVE-2007-3513 : In the Linux kernel, the lcd_write function in drivers/usb/misc/usblcd.c does not limit memory used by a caller, allowing a local user to exhaust memory and cause a denial of service. Affected until 2.6.22-rc7; remediation is upgrading to 2.6.22-rc7 or later where the issue is fix...

CVE-2009-2287

CVE-2009-2287 affects the Linux kernel’s KVM on x86, where KVM_SET_SREGS does not validate the page-table root (cr3). This can allow a local attacker to crash or hang the host (denial of service) via a crafted cr3 value, triggering a NULL pointer dereference in gfn_to_rmap. The issue is documente...

CVE-2009-2768

The vulnerability CVE-2009-2768 affects the Linux kernel flat subsystem (fs/binfmt_flat.c: load_flat_shared_library). It allows local users to trigger a NULL pointer dereference by executing a shared flat binary, potentially causing a denial of service and system crash, via an uninitialized cred ...

CVE-2009-3234

Affected software: Linux kernel 2.6.31-rc1. The vulnerability is a buffer overflow in the perf_copy_attr function of kernel/perf_counter.c, exploitable via perf_counter_open. Local attackers can crash the kernel (denial of service) and may execute arbitrary code. No exploitation status or patch d...

CVE-2011-0999

CVE-2011-0999 affects the Linux kernel (mm/huge_memory.c) up to 2.6.38-rc5. A local attacker could trigger creation of a transparent huge page (THP) during a temporary stack for an exec() call, enabling memory exhaustion and potential other impact. The issue is caused by not preventing THP creati...

CVE-2013-2546

CVE-2013-2546 concerns the Linux kernel 3.8.2 era: the crypto report API in the crypto user configuration API uses an incorrect string-copy function, enabling a local attacker with CAP_NET_ADMIN to leak information from kernel stack memory. The vulnerability is scoped to the report API in the ker...

CVE-2013-7348

CVE-2013-7348 describes a double free vulnerability in the Linux kernel’s ioctx_alloc (fs/aio.c) prior to 3.12.4. An error path in aio_setup_ring can lead to a use-after-free like condition that enables a local attacker to trigger a system crash (DoS) or potentially other impact. The cited public...

CVE-2015-0568

The CVE-2015-0568 entry describes a use-after-free in the MSM-Camera driver (drivers/media/video/msm/msm_camera.c), in the msm_set_crop function, for the Linux kernel 3.x used with Qualcomm Innovation Center (QuIC) Android contributions. A crafted ioctl call from a local attacker can trigger memo...

CVE-2016-8432

CVE-2016-8432 describes an elevation-of-privilege in the NVIDIA GPU driver on Android with kernel-3.18, enabling a local malicious app to run arbitrary code in kernel context. Affected product: Android devices using NVIDIA GPU drivers (Pixel C cited in Google's patch table). Impact is labeled Cri...

CVE-2017-9211

The CVE-2017-9211 flaw affects the Linux kernel component crypto_skcipher_init_tfm in crypto/skcipher.c up to version 4.11.2. It relies on setkey without a key-size check, allowing a local user to cause a denial of service via a NULL pointer dereference. The connected documents indicate a patch/c...

CVE-2020-36790

The CVE-2020-36790 entry refers to a Linux kernel issue where a memory leak in nvmet was fixed: specifically, the code failed to free the new_model_number. The connected documents consistently identify this as a resolved kernel vulnerability (nvmet: fix a memory leak) with no additional exploit d...

CVE-2022-48965

CVE-2022-48965 concerns a refcount leak in rockchip_gpiolib_register() within linux-5.x kernels. The root cause is a missing of_node_put() for the parent node after obtaining it with of_get_parent(). The fix adds of_node_put() at the end of of_pinctrl_get() to balance the refcount. Multiple advis...

CVE-2022-49854

CVE-2022-49854 concerns the Linux kernel: a resource leak in the mctp_init() error path when mctp_neigh_init() returns an error. The issue is resolved by ensuring route resources are released in the error handling path, preventing leaks. Affected component: mctp subsystem in the kernel; impact is...

CVE-2022-49867

CVE-2022-49867 : In the Linux kernel IOSM driver (net: wwan: iosm), the device was registered without setting needs_free_netdev and free_netdev() was not called on unregister, causing a memory leak. The published patch enables needs_free_netdev to true at registration, so the netdev subsystem wil...

CVE-2022-49959

The CVE-2022-49959 entry concerns a memory-leak in the Linux kernel related to openvswitch datapath creation. The root cause was that ovs_dp_cmd_new()->ovs_dp_change()->ovs_dp_set_upcall_portids() allocated an array with kmalloc but did not always free dp->upcall_portids when new_vport()...

CVE-2022-50005

The CVE-2022-50005 issue concerns Linux kernel NFC code for pn533 devices. The root cause is a use-after-free caused by a timer (cmd_timeout) not being canceled during pn532_uart_remove(), allowing a concurrent use path to dereference freed memory. The fix adds del_timer_sync() in pn532_uart_remo...

CVE-2022-50007

CVE-2022-50007: In the Linux kernel xfrm_policy_check(), on the error path when fetching pols[1] fails, pols[0] is not decremented, causing a refcount leak. The fix adds a decref for pols[0] in that path. Affected component: Linux kernel xfrm policy check. Impact described as memory leaks on erro...

CVE-2022-50121

CVE-2022-50121 affects the Linux kernel remoteproc code for k3-r5, where a missing of_node_put() in for_each_available_child_of_node() can leak a refcount when breaking early from the loop. The root cause is that each iteration decrements the previous node’s reference count without explicit relea...

CVE-2022-50186

The CVE-2022-50186 entry concerns a Linux kernel issue in ath11k where on htc_tx_completion error the skb was not dropped, leading to a memory leak. The documented fix ensures the skb is freed on eid >= ATH11K_HTC_EP_COUNT before returning, as the completion_handler expects consumption even in...

CVE-2022-50188

CVE-2022-50188 is a Linux kernel vulnerability where a refcount leak in drm/meson was fixed. The issue arose because of how of_find_device_by_node() held a reference, with missing put_device() in the error path, leading to a refcount leak. The fix patches the kernel (meson_encoder_hdmi_init) to r...

CVE-2022-50189

CVE-2022-50189 relates to a Linux kernel turbostat issue where a FILE pointer leak occurs if fscanf fails, causing an open file pointer to be leaked on an early return. The fix closes the file before returning (turbostat.c:2039) to remediate the resource leak. Affected component: Linux kernel tur...

CVE-2022-50204

CVE-2022-50204 concerns a Linux kernel issue affecting ARM OMAP2+ where pdata-quirks leaked a refcount in pdata_quirks_init_clocks due to a missing of_node_put() after using of_find_node_by_name() in a loop. The vulnerability is mitigated by a kernel fix that corrects the refcount handling, preve...

CVE-2022-50208

CVE-2022-50208 affects the Linux kernel, specifically the soc: amlogic driver code for meson-secure-pwrc.c. In meson_secure_pwrc_probe(), there is a refcount leak on one failure path, which is the root cause described in the Initial Document. The vulnerability is fixed in the same area (refcount ...

CVE-2022-50350

The CVE-2022-50350 issue is a Linux kernel vulnerability in the iscsi target login path. It describes a race between login_work and the login thread when a malicious initiator sends data after login, which could result in the login_work looping and a NULL pointer dereference if the socket is free...

CVE-2023-52684

The Linux kernel contains a memory leak vulnerability in the Qualcomm Secure Execution Environment (QSEE) communication driver (qseecom ), specifically within the drivers/firmware/qcom/qcom_qseecom_uefisecapp.c module. The issue stems from the qsee_uefi_get_variable() function, where error codes ...

CVE-2023-53055

CVE-2023-53055 : In the Linux kernel, fscrypt_destroy_keyring() must be called after all potentially-encrypted inodes are evicted, specifically after security_sb_delete(), because inodes in-use by the Landlock LSM are not evicted until that point. If called earlier, a WARN_ON may lead to a NULL d...