CVE-2024-43878

CVE-2024-43878 — Linux kernel xfrm: Fix input error path memory access . Affected component: the Linux kernel networking/xfrm stack (xfrmi_rcv_cb). Root cause: memory access during the input slow-path handling when input state is misconfigured, leading to a KASAN wild-memory-access read (observed...

CVE-2024-46690

The CVE-2024-46690 entry documents a Linux kernel issue in nfsd4_deleg_getattr_conflict when a third‑party lease manager is present. The vulnerability stemmed from unsafe dereference of fl->c.flc_owner without verifying fl->fl_lmops, causing incorrect handling of nfsd4_deleg_getattr_conflic...

CVE-2024-46699

CVE-2024-46699: In the Linux kernel, drm/v3d preemption was not disabled around the write_seqcount_begin/end() used to update GPU stats, risking seqcount/RCU race conditions. Root cause: missing __seqprop_assert around the update path in v3d stats code leading to potential data corruption under p...

CVE-2025-21845

Technical details about CVE-2025-21845 are not provided in the connected documents. The initial description summarizes the issue; monitor for updates.

CVE-2025-38029

CVE-2025-38029 (Linux kernel) : The issue occurs in kasan when apply_to_pte_range enters lazy MMU mode and invokes kasan_populate_vmalloc_pte(), which can sleep while allocating a single page. This can crash in-context on certain arches (e.g., s390) when preemption is manipulated during lazy MMU ...

CVE-2025-38208

CVE-2025-38208 is resolved in the Linux kernel: smb client adds a NULL check in automount_fullpath to prevent NULL dereference when tcon->origin_fullpath is set. The issue was a missing null check in __build_path_from_dentry_optional_prefix for the case when origin_fullpath is present. Affects...

CVE-2025-38306

CVE-2025-38306 concerns the Linux kernel. It describes a race in fs/fhandle.c where may_decode_fh() can call has_locked_children() without holding locks, enabling an oopsable race. The fix renames has_locked_children() to __has_locked_children(), makes it static, and updates callers in fs/namespa...

CVE-2025-38491

CVE-2025-38491: In the Linux kernel, the mptcp fallback action and fallback decision were made atomic to fix a race condition reported by Syzkaller. The issue affected the Multipath TCP (MPTCP) path establishment logic, potentially enabling a race between fallback paths during connection setup. T...

CVE-2025-38706

In CVE-2025-38706, the Linux kernel ASoC core vulnerability arises when snd_soc_remove_pcm_runtime() is called with rtd == NULL, leading to a NULL pointer dereference. The issue was reproduced during topology loading and marking a link as ignore due to a missing hardware component; on module remo...

CVE-2025-38718

CVE-2025-38718 affects the Linux kernel SCTP implementation. The issue arises when cloning head skbs with fraglists, causing use-after-likes from sharing frag skbs and leading to uninitialized-value bugs (KMSAN) in sctp_inq_pop and related code paths. The fix patches sctp_rcv() to linearize clone...

CVE-2025-39757

CVE-2025-39757 is a Linux kernel/ALSA USB-audio issue where UAC3 cluster segment descriptors were not validated for sizes against declared lengths or allocated buffers, enabling potential out-of-bounds (OOB) access. Connected advisories (Astra Linux and kernel security bulletins) confirm the vuln...

CVE-2025-39953

CVE-2025-39953 (Linux kernel) : The issue arises in cgroup destruction where root destruction can hang during repeated perf_event/net_prio unmounts with systemd.unified_cgroup_hierarchy=1. Root cause shows root destruction enqueues, while offline work is blocked by the same wq, causing a hang. Th...

CVE-2025-40040

CVE-2025-40040 (Linux kernel) affects the flag-dropping behavior in mm/ksm when madvise() is used on a UFFD-registered VMA. The issue arises from the interaction of VM_MERGEABLE and 32/64-bit width when applying the &= ~VM_MERGEABLE on vm_flags, which can clear the upper 32 bits and trigger a ker...

CVE-2025-71100

CVE-2025-71100 affects the Linux kernel wifi rtl8192cu (rtlwifi). The issue arises when tid values from ieee80211_get_tid() may exceed the bounds of sta_entry->tids[] (MAX_TID_COUNT), triggering an out-of-bounds access and UBSAN warning. The patched code adds a bounds check to ensure TID

CVE-2026-23398

CVE-2026-23398 — Linux kernel icmp_tag_validation NULL pointer dereference has concrete details in the provided documents. The vulnerability occurs when icmp_tag_validation() dereferences inet_protos[proto] without a NULL check for an unregistered protocol number in an ICMP Fragmentation Needed p...

CVE-2026-46063

The CVE-2026-46063 issue affects the Linux kernel with x86 shadow stack (shstk) handling of sigreturn. Root cause: during a shadow-stack sigframe read, the kernel previously held the mmap lock while verifying VMA flags to distinguish shadow stack memory. A page fault during this read could trigge...

CVE-2026-46151

CVE-2026-46151 affects the Linux kernel USB printer driver usblp, causing a heap leak in IEEE 1284 device ID handling due to short GET_DEVICE_ID responses. The issue stems from usblp_ctrl_msg() discarding actual bytes and usblp_cache_device_id_string() trusting a 2‑byte length prefix, exposing st...

CVE-2026-46212

CVE-2026-46212 concerns the Linux kernel’s batman-adv module. The vulnerability arises when deleting backbone claims in batman-adv (function batadv_bla_del_backbone_claims): the code drops a hash-list link entry that is still referenced, risking that the entry could be freed by batadv_claim_relea...

CVE-2026-53335

The CVE-2026-53335 issue concerns the Linux kernel DAMON_LRU_SORT path (mm/damon/lru_sort). The root cause is damon_ctx allocation failure in the init path, which may lead to a NULL ctx passed to damon_commit_ctx() and a NULL pointer dereference. The documented fix is to return -ENOMEM if ctx is ...

CVE-2026-53382

CVE-2026-53382 affects the Linux kernel’s media/vidtv subsystem. The issue arises when vidtv_mux_get_pid_ctx() returns NULL and vidtv_mux_push_si() dereferences it to access the continuity counter, triggering a general protection fault. Root cause: vidtv_mux_pid_ctx_init() could skip creating a P...

CVE-2026-64378

CVE-2026-64378 is a Linux kernel race between cgroup_writeback_umount() and inode_switch_wbs()/cleanup_offline_cgwb() triggered when a container exits. The root cause is a window between inode_prepare_wbs_switch() returning true and wb_queue_isw(), which can lead to a VFS: Busy inodes after unmou...

CVE-2026-64448

Summary (CVE-2026-64448): The Linux kernel fix addresses a SMB2 negotiation bug in CIFS/NTLM handling. A long-standing quirk in smb2_check_message() unconditionally granted a +1 length exemption for responses, even when a data area was present. This could cause the decoder to read past the receiv...

CVE-2002-0060

CVE-2002-0060 affects the Linux kernel netfilter IRC DCC connection-tracking helper in 2.4.x (notably 2.4.14–2.4.18-pre8/9). The bug sets an overly broad conntrack mask, causing firewall rules to be more permissive than intended and potentially allowing inbound connections that bypass restriction...

CVE-2005-3110

CVE-2005-3110 is a race condition in the Linux kernel after the ebtables netfilter module tightens lock handling. In SMP systems under heavy load, a value can be modified after it is read but before it is locked, enabling a remote attacker to cause a kernel crash (DoS). Public advisories referenc...

CVE-2005-3858

Technical details about CVE-2005-3858 are not publicly available in the provided connected documents. Monitor for updates.

CVE-2006-1242

CVE-2006-1242 affects the Linux kernel (2.4.x and 2.6.x up to before 2.6.16). The ip_push_pending_frames function increments the IP ID when sending a RST after unsolicited TCP SYN-ACKs, enabling remote Idle-Scan (nmap -sI) bypassing certain protections. Affected versions: Linux 2.4.x and 2.6.x be...

CVE-2011-1747

CVE-2011-1747 affects the Linux kernel AGP subsystem (2.6.38.5 and earlier). The vulnerability stems from inadequate restriction of memory allocations for AGPIOC_RESERVE and AGPIOC_ALLOCATE ioctls in the AGP driver, allowing a local attacker with access to the video subsystem to induce memory exh...

CVE-2011-2209

The CVE-2011-2209 issue affects the Linux kernel on the Alpha architecture, where an integer signedness error in osf_sysinfo (arch/alpha/kernel/osf_sys.c) could allow local users to obtain sensitive information from kernel memory via a crafted call. Vulnerable when using kernel versions before 2....

CVE-2011-3619

CVE-2011-3619 affects the Linux kernel (before 3.0) via AppArmor’s apparmor_setprocattr in security/apparmor/lsm.c. Unvalidated parameters can trigger a NULL pointer dereference/OOPS by writing to /proc/#####/attr/current, enabling local denial-of-service; kernel patch exists in 3.0+ (see ChangeL...

CVE-2011-4087

CVE-2011-4087 affects the Linux kernel up to version 2.6.38, where the function br_parse_ip_options in net/bridge/br_netfilter.c fails to initialize a data structure properly. This can allow remote attackers to cause a denial of service by manipulating connectivity to an Ethernet bridge-enabled n...

CVE-2011-4604

CVE-2011-4604 affects the Linux kernel via batman-adv: the bat_socket_read function in net/batman-adv/icmp_socket.c allows remote memory corruption/DoS via crafted batman-adv ICMP packets. Affected: kernel versions prior to 3.3. Root cause: ICMP handling in batman-adv. Impact: memory corruption a...

CVE-2013-2546

CVE-2013-2546 concerns the Linux kernel 3.8.2 era: the crypto report API in the crypto user configuration API uses an incorrect string-copy function, enabling a local attacker with CAP_NET_ADMIN to leak information from kernel stack memory. The vulnerability is scoped to the report API in the ker...

CVE-2016-6761

CVE-2016-6761 describes an elevation of privilege vulnerability in Qualcomm media codecs on Android. A local malicious app could execute arbitrary code within the context of a privileged process due to this flaw in the media codecs. Affected devices include Nexus 5X/6/6P, Nexus 9, Android One, Ne...

CVE-2021-47125

CVE-2021-47125 concerns a Linux kernel local vulnerability due to a refcount leak in the HTB offload path. The root cause was an incorrect NULL handling around qdisc_refcount_inc in htb_parent_to_leaf_offload, which could leak references if new_q was NULL. The fix adds a NULL pointer check to gua...

CVE-2021-47278

CVE-2021-47278 : Linux kernel vulnerability in the bus: mhi: pci_generic driver where the remove path used del_timer(), which may not wait for the timer handler to finish, causing a potential use-after-free. The fix is to replace del_timer() with del_timer_sync() to ensure the timer handler has f...

CVE-2022-48719

CVE-2022-48719 concerns a Linux kernel issue in the neighbor subsystem where an NUD_FAILED entry could trigger an immediate probe due to neigh_event_send behavior when under certain managed state conditions. The root cause involved a potential deadlock path with NTF_MANAGED entries and a chain of...

CVE-2022-48782

In the Linux kernel, CVE-2022-48782 concerns a use-after-free in the MCTP route logic. Specifically, after mctp_key_add() fails, the freed key is later used in trace_mctp_key_acquire(), creating memory-safety issues. A fix is described as adding an else branch to use the key only when mctp_key_ad...

CVE-2022-48820

CVE-2022-48820: In the Linux kernel, a refcount leak was fixed in the stm32 USB PHY PLL enable path. The bug affected the stm32_usbphyc_pll_enable() error path where usbphyc->n_pll_cons.counter was not decremented, potentially leaking a reference. The provided connected documents confirm the f...

CVE-2022-49068

CVE-2022-49068 — Summary (Linux kernel, btrfs) The issue occurs in btrfs direct IO write path: during get_blocks_direct_write(), temporary delalloc extents are reserved and later released with btrfs_delalloc_release_extents(). If the length is modified in the COW path, fewer extents may be releas...

CVE-2022-50155

CVE-2022-50155 concerns the Linux kernel MTDi parsing code: a refcount leak in bcm4908_partitions_fw_offset was fixed by ensuring of_node_put() is called after of_find_node_by_path() returns a node. The vulnerability affects the kernel component responsible for partition parsing (mtd: parsers: of...

CVE-2022-50204

CVE-2022-50204 concerns a Linux kernel issue affecting ARM OMAP2+ where pdata-quirks leaked a refcount in pdata_quirks_init_clocks due to a missing of_node_put() after using of_find_node_by_name() in a loop. The vulnerability is mitigated by a kernel fix that corrects the refcount handling, preve...

CVE-2023-32810

The CVE-2023-32810 entry applies to the Bluetooth driver in MediaTek devices. The vulnerability is an out-of-bounds read caused by improper input validation in the Bluetooth driver, which can lead to local information leakage and potentially System-level execution privileges. Exploitation is desc...

CVE-2023-52987

CVE-2023-52987 affects the Linux kernel ASoC SOF component: ipc4-mtrace code path. The vulnerability arises from an underflow in sof_ipc4_priority_mask_dfs_write() caused by using a signed id that should be unsigned, leading to an array underflow. The available connected documents consistently st...

CVE-2023-53136

CVE-2023-53136 concerns a Linux kernel af_unix memory leak in OOB support. The root cause is that queue_oob() may hold a reference on a pid via maybe_add_creds(), while skb->destructor is not set (directly or via unix_scm_to_skb()), allowing the reference to be leaked when the skb is freed. Sy...

CVE-2024-38626

CVE-2024-38626 affects the Linux kernel’s FUSE subsystem (fs/fuse/dev.c). The issue arises from not clearing the FR_SENT flag when re-adding requests from the processing list to the pending list after a FUSE_NOTIFY_RESEND, which can cause a use-after‑read scenario and trigger a warning in fuse_re...

CVE-2024-46688

CVE-2024-46688 - Linux kernel erofs fix : The issue is an out-of-bound access in erofs when z_erofs_gbuf_growsize() partially fails, potentially causing NULL-pointer dereference or memory leaks if the old gbuf->pages[] array is too small. The documented mitigation is to compare against gbuf-&g...

CVE-2024-46696

The CVE-2024-46696 issue affects the Linux kernel’s NFS daemon (nfsd), specifically the nfsd4_cb_getattr_release path. The root cause is a use-after-free (UAF) risk that arises after dropping a delegation reference; the vulnerable fields can be accessed only if the reference is still considered v...

CVE-2024-56668

The CVE-2024-56668 issue affects the Linux kernel iommu/vt-d path where qi_batch could be NULL for nested parent domains, risking a kernel NULL pointer dereference and a potential memory leak due to lack of locking around domain->qi_batch allocation. The root cause is that qi_batch was not all...

CVE-2025-21797

The CVE-2025-21797 entry concerns the Linux kernel HID driver for Corsair void headsets. The vulnerability arises from a missed cancel_delayed_work_sync() in corsair_void_remove(), causing a use-after-free. The issue affects the kernel component handling headset status and is rated with CVSS v3.1...

CVE-2025-21933

CVE-2025-21933: In the Linux kernel (ARM), a NULL pointer dereference can occur in pgtable when update_mmu_cache_range() is invoked with a NULL vmf, causing a NULL dereference in adjust_pte(). The issue is triggered by how PTE locks are acquired; the fix changes the lock decision to be based on w...