CVE-2017-0403

CVE-2017-0403 is an elevation-of-privilege vulnerability in the Android kernel performance subsystem. The issue could allow a local malicious application to execute arbitrary code within the kernel context, requiring initial access via a privileged process. Affected software is Android’s kernel w...

CVE-2017-0439

CVE-2017-0439 describes a local privilege-escalation vulnerability in the Qualcomm Wi‑Fi driver for Android, affecting Kernel-3.10 and Kernel-3.18. The issue could allow a local malicious app to execute arbitrary code in the kernel context after compromising a privileged process. The Android Prod...

CVE-2017-0460

CVE-2017-0460 describes a local elevation-of-privilege in the Qualcomm networking driver on Android, allowing a malicious local app to execute code in the kernel. Affected are Android kernels 3.10 and 3.18; the exploit requires compromising a privileged process and does not appear to be remotely ...

CVE-2017-0527

CVE-2017-0527 describes an elevation-of-privilege vulnerability in the HTC Sensor Hub Driver on Android, enabling a local malicious app to execute arbitrary code in kernel context. Affected products/versions: Android on kernel 3.10 and 3.18. Root cause is operating in the context of the kernel af...

CVE-2018-19406

CVE-2018-19406 affects the Linux kernel up to version 4.19.2, specifically kvm_pv_send_ipi in arch/x86/kvm/lapic.c. A crafted system call can reach a state where the APIC map is uninitialized, leading to a NULL pointer dereference and a BUG, causing a local denial of service. Connected advisories...

CVE-2021-47570

CVE-2021-47570 is addressed in the Linux kernel staging area (rt8188eu driver). The issue was a memory leak in rtw_wx_read32() where ptmp was not freed before returning -EINVAL. A fix (memory cleanup) has been applied to resolve this vulnerability; references point to kernel stable commits that i...

CVE-2022-48661

CVE-2022-48661 in the Linux kernel relates to the gpio: mockup code where, if software node creation fails, the locally allocated string array isn’t freed, causing a potential resource leakage. The available connected documentation confirms this root cause and states the vulnerability has been re...

CVE-2022-48719

CVE-2022-48719 concerns a Linux kernel issue in the neighbor subsystem where an NUD_FAILED entry could trigger an immediate probe due to neigh_event_send behavior when under certain managed state conditions. The root cause involved a potential deadlock path with NTF_MANAGED entries and a chain of...

CVE-2022-48764

CVE-2022-48764 concerns the Linux kernel KVM x86 CPUID handling. The provided documents consistently describe a memory-leak issue where the kernel did not free the kvm_cpuid_entry2 array after successful post-KVM_RUN KVM_SET_CPUID{,2} calls, potentially leaving an unreferenced 2048-byte object (e...

CVE-2022-48820

CVE-2022-48820: In the Linux kernel, a refcount leak was fixed in the stm32 USB PHY PLL enable path. The bug affected the stm32_usbphyc_pll_enable() error path where usbphyc->n_pll_cons.counter was not decremented, potentially leaking a reference. The provided connected documents confirm the f...

CVE-2022-49079

CVE-2022-49079 involves the Linux kernel Btrfs zoned code. Root cause: btrfs_can_activate_zone() could be invoked with fs_devices->device_list_mutex already held, risking deadlock through a long call chain (insert_dev_extents -> find_free_extent -> can_allocate_chunk etc.). Mitigation de...

CVE-2022-49791

The CVE-2022-49791 entry is about a Linux kernel issue in io_uring where a multishot accept request can leak if REQ_F_POLLED is set and the code misclassifies the operation as multishot from the polling path. The problem could lead to leaking the request by a skip-completion path, and the remedia...

CVE-2022-49866

CVE-2022-49866 concerns a memory‑leak in the Linux kernel’s MHI/wwan path: the MHI driver registered a network device without marking needs_free_netdev, so free_netdev() wasn’t called on unregister. The public sources describe a patch that sets needs_free_netdev to true when registering the netwo...

CVE-2022-49883

CVE-2022-49883 is a Linux kernel KVM x86 vulnerability related to SMM handling. The issue arises because the number of general purpose registers (GPRs) used for the SMRAM image depends on the image format. On 64‑bit hosts, if the guest lacks X86_FEATURE_LM, KVM may access 16 GPRs for a 32‑bit SMR...

CVE-2022-49912

CVE-2022-49912 is a Linux kernel vulnerability affecting btrfs qgroup self tests, where the old_roots ulist could leak on error paths when failing to add tree refs or remove extent data. The fix ensures the ulist is freed (ulist_free) before returning from the test paths, mitigating the leak. No ...

CVE-2022-50192

CVE-2022-50192 : In the Linux kernel, the vulnerability affects the SPI Tegra tegra20-slink path. After calling spi_unregister_master(), the master’s refcount can drop to 0 and the master (and its associated device data) may be freed, causing a use-after-free when using tspi. The fix ensures the ...

CVE-2022-50223

CVE-2022-50223 affects the Linux kernel on LoongArch where, when CONFIG_CPUMASK_OFFSTACK and CONFIG_DEBUG_PER_CPU_MAPS are enabled, cpu_max_bits_warn() could trigger a runtime warning during /proc/cpuinfo display. The issue arises from iterating CPUs using NR_CPUS and is fixed by using nr_cpu_ids...

CVE-2023-53136

CVE-2023-53136 concerns a Linux kernel af_unix memory leak in OOB support. The root cause is that queue_oob() may hold a reference on a pid via maybe_add_creds(), while skb->destructor is not set (directly or via unix_scm_to_skb()), allowing the reference to be leaked when the skb is freed. Sy...

CVE-2024-42233

CVE-2024-42233 concerns a Linux kernel memory-management issue in filemap_fault_recheck_pte_none() where vmf->ptl could be stale after a pte_unmap(), potentially allowing page-table races. The fix is to replace pte_offset_map() with pte_offset_map_nolock(), removing reliance on PTL for protect...

CVE-2024-43878

CVE-2024-43878 — Linux kernel xfrm: Fix input error path memory access . Affected component: the Linux kernel networking/xfrm stack (xfrmi_rcv_cb). Root cause: memory access during the input slow-path handling when input state is misconfigured, leading to a KASAN wild-memory-access read (observed...

CVE-2024-46688

CVE-2024-46688 - Linux kernel erofs fix : The issue is an out-of-bound access in erofs when z_erofs_gbuf_growsize() partially fails, potentially causing NULL-pointer dereference or memory leaks if the old gbuf->pages[] array is too small. The documented mitigation is to compare against gbuf-&g...

CVE-2024-46690

The CVE-2024-46690 entry documents a Linux kernel issue in nfsd4_deleg_getattr_conflict when a third‑party lease manager is present. The vulnerability stemmed from unsafe dereference of fl->c.flc_owner without verifying fl->fl_lmops, causing incorrect handling of nfsd4_deleg_getattr_conflic...

CVE-2024-46696

The CVE-2024-46696 issue affects the Linux kernel’s NFS daemon (nfsd), specifically the nfsd4_cb_getattr_release path. The root cause is a use-after-free (UAF) risk that arises after dropping a delegation reference; the vulnerable fields can be accessed only if the reference is still considered v...

CVE-2024-58022

CVE-2024-58022 relates to a NULL vs IS_ERR() handling bug in the Linux kernel’s mailbox th1520 path. The vulnerable code used to treat NULL returns from devm_ioremap() as errors consistent with IS_ERR() checks, which is incorrect since devm_ioremap() returns NULL on failure. The fixed description...

CVE-2025-38033

CVE-2025-38033 affects the Linux kernel (x86) where FineIBT and Rust integration triggers a kernel panic when core::fmt::write() is invoked from Rust with FineIBT enabled. Root cause is that core::fmt::rt::Argument::fmt() has CFI-disabled code (no_sanitize(cfi, kcfi)), causing a Control Protectio...

CVE-2025-38036

The CVE-2025-38036 entry describes a Linux kernel issue in drm/xe/vf where GuC communication required GT MMIO to be initialized. Root cause: gt->mmio was initialized late due to recent refactoring, causing GuC calls to xe_mmio_read|write() to crash with an NPD when attempting to access MMIO ad...

CVE-2025-38134

CVE-2025-38134 in Linux kernel: The usb: acpi: fix prevents a NULL pointer dereference in usb_acpi_add_usb4_devlink() due to usb_hub_to_struct_hub() returning NULL in certain hub teardown scenarios. The issue could lead to an access to hub->ports[...] if NULL, and was mitigated by guards in ot...

CVE-2025-38199

The connected Astra/Linux kernel advisory describes CVE-2025-38199 as a memory leak in wifi/ath12k where arsta->rx_stats was allocated each time a station was added, including repeated additions for the same station. The root cause is redundant allocations when ath12k_mac_station_add() is call...

CVE-2025-38208

CVE-2025-38208 is resolved in the Linux kernel: smb client adds a NULL check in automount_fullpath to prevent NULL dereference when tcon->origin_fullpath is set. The issue was a missing null check in __build_path_from_dentry_optional_prefix for the case when origin_fullpath is present. Affects...

CVE-2025-38278

CVE-2025-38278 affects the Linux kernel’s octeontx2-pf traffic shaper (TC_HTB_LEAF_DEL_LAST callback). The patch refactors the callback to stop active leaf-node traffic before reassigning its send queue to the parent and to handle reboot scenarios where TC_HTB_LEAF_DEL and TC_HTB_LEAF_DEL_LAST ma...

CVE-2025-38295

Consolidated data shows CVE-2025-38295 affects the Linux kernel Amlogic Meson DDR PMU driver (meson_ddr_pmu_create) where smp_processor_id() was used in a preemptible context. This caused kernel warnings during module loading. The root cause is unsafe CPU-ID retrieval in preemptible code; the fix...

CVE-2025-38571

CVE-2025-38571 is a Linux kernel vulnerability affecting sunrpc/NFS over TLS. The issue arises from the client-side handling of TLS alerts in tls_alert_recv, caused by an assumption that the msghdr iterator’s kvec contains valid data. The patch reworks how control messages are set up and used by ...

CVE-2025-38734

Summary (CVE-2025-38734): Affected component is Linux kernel net/smc. The vulnerability stems from a use-after-free risk where newclcsock->sk may be NULL after smc_listen_out_connected() releases smcsk. If a user app closes the accepted socket immediately after accept(), the code path can dere...

CVE-2026-23025

CVE-2026-23025 : In the Linux kernel, drain_page_zone() could corrupt per-CPU pages (pcp) when an interrupt occurs and code path uses spin_lock(&pcp->lock) with SMP=n, because spin_trylock() may fail. The issue enables potential pcp structure corruption. The fix adds local wrappers that conver...

CVE-2026-23198

CVE-2026-23198 relates to the Linux kernel KVM irqfd handling. The vulnerability arose when deassociating an IRQFD could clobber the irqfd’s copy of the IRQ’s routing entry, causing arch-specific code (e.g., kvm_arch_irq_bypass_del_producer on x86/arm64) to misinterpret routing as MSI. The fix ch...

CVE-2026-31411

CVE-2026-31411: Linux kernel ATM signaling path (net/atm) allowed forged user pointers via sendmsg(), leading to potential memory safety risks. A fix adds find_get_vcc() to validate the vcc pointer against the vcc_hash and uses sock_hold() to keep the object alive during processing of signaling o...

CVE-2026-31629

The CVE-2026-31629 vulnerability affects the Linux kernel NFC LLCP subsystem. Specifically, in nfc_llcp_recv_hdlc() and nfc_llcp_recv_disc(), when the socket state is LLCP_CLOSED, the code correctly releases resources but lacks an early return, causing fall-through to subsequent release calls. Th...

CVE-2026-43071

CVE-2026-43071 affects the Linux kernel dcache component, specifically an OOB read in dentry_hashtable when dhash_entries is set to 1. The root cause is incorrect d_hash_shift calculation, causing an access to unallocated memory and potential kernel panic/DoS. The issue is mitigated by patching t...

CVE-2026-43083

The CVE pertains to Linux kernel ioam6: a fix for an out-of-bounds access in skb_get_tx_queue when is_input is true, caused by a RX->TX queue-mapping mismatch (ingress device having more RX queues than egress TX queues). The issue could access dev->_tx[] beyond its bounds. A lock around qdi...

CVE-2026-45999

The CVE-2026-45999 issue affects the Linux kernel EROFS LZ4 inplace decompression path (z_erofs_lz4_handle_overlap). Crafted extents can trigger an unsigned underflow (outpages

CVE-2026-46304

MODE C: The CVE-2026-46304 entry centers on the Linux kernel nvmet subsystem. The vulnerability stems from nvmet_tcp_release_queue_work() running on the nvmet-wq and possibly dropping the final controller reference through nvmet_cq_put(), which can trigger nvmet_ctrl_free() and flush ctrl->asy...

CVE-2026-53247

CVE-2026-53247: Linux kernel MTK ethernet driver (mtk_eth_soc) fix for use-after-free in metadata_dst teardown. mtk_free_dev() previously called metadata_dst_free() (kfree’d immediately, bypassing RCU). In RX, skb_dst_set_noref() kept non-refcounted pointers to metadata_dst; freed memory could ra...

CVE-2026-53388

CVE-2026-53388 : Linux kernel fuse module vulnerability where fuse_try_move_folio() unlocks the request on entry but does not re-lock on the success path, allowing a use-after-free of fuse_io_args via fuse_chan_abort() and delayed copying logic. The issue is resolved by calling lock_request() bef...

CVE-2001-0405

Concrete details: CVE-2001-0405 affects ip_conntrack_ftp inside the Linux 2.4 iptables RELATED connection tracking. A crafted FTP PORT command could cause the firewall to allow an arbitrary IP/port through the RELATED table, bypassing access restrictions. Implication: arbitrary firewall holes for...

CVE-2003-0476

CVE-2003-0476 affects the Linux kernel 2.4.x execve system call, where the executable’s file descriptor is recorded in the caller’s file table, enabling local users to read restricted file descriptors. Public advisories (e.g., Debian DSA-423-1, RHSA-2003:408) note this vulnerability and recommend...

CVE-2005-0176

The CVE-2005-0176 issue affects the Linux kernel (2.6.9 and earlier) where shmctl-based locking of System V shared memory could be misused by local unprivileged users to unlock memory from other processes. This could cause sensitive memory contents to be swapped to disk and read by others after r...

CVE-2005-3848

CVE-2005-3848 concerns a memory leak in the Linux kernel’s icmp_push_reply() that can be triggered by crafting a large number of ICMP packets, causing memory consumption and a denial of service. Public details in the initial entry specify Linux kernels before 2.6.12.6 and 2.6.13 are affected, wit...

CVE-2006-1342

CVE-2006-1342 is a local information-leak in the Linux kernel’s IPv4 socket-name handling. The root cause is that sockaddr_in.sin_zero is not cleared when returning IPv4 socket names from getsockname, getpeername, or accept, potentially exposing portions of kernel memory. Public advisories across...

CVE-2006-1522

CVE-2006-1522 affects Linux kernel 2.6.16.1 and 2.6.17-rc1 (and possibly earlier). The sys_add_key function in the keyring code may add a key to a user key instead of a keyring, causing an invalid dereference in __keyring_search_one and resulting in a local DoS (OOPS) / kernel crash. The vulnerab...

CVE-2006-5173

CVE-2006-5173 concerns the Linux kernel: local users can trigger a denial-of-service by mismanaging EFLAGS during context switches and thread creation (Alignment Check flag 0x40000), causing SIGBUS in other processes with unaligned accesses. Multiple connected sources confirm the issue and refere...