CVE-2026-23209

CVE-2026-23209 is a Linux kernel macvlan bug. The issue occurs in macvlan when creating a new link with MACVLAN_MODE_SOURCE and MACVLAN_MACADDR_ADD/SET and the lower device already has a macvlan port, causing a use-after-free after a failed register_netdevice() in the create path. Upstream kernel...

CVE-2022-49904

The CVE-2022-49904 entry documents a Linux kernel vulnerability in net/neigh: a null-ptr-deref in neigh_table_clear() that occurs when IPv6 initialization fails and cleanup calls pneigh_queue_purge() with a NULL device. The fix, as described, is to pass NULL to pneigh_queue_purge() in neigh_ifdow...

CVE-2025-38512

Intel/summary (CVE-2025-38512) The Linux kernel patch for wifi A-MSDU spoofing in mesh networks fixes a vulnerability where an A‑MSDU could be incorrectly parsed as a standard MSDU. The mitigation detects this by parsing a received A‑MSDU as MSDU, computing the Mesh Control header length, and ver...

CVE-2025-38566

CVE-2025-38566 concerns the Linux kernel where the NFS over TLS path could mishandle TLS alerts in tls_alert_recv() due to how the kTLS control messages and data are split between the control buffer and the payload. The fix reworks how sock_recvmsg() sets up control messages so that, if a TLS con...

CVE-2026-22999

CVE-2026-22999 is addressed by fixes in the Linux kernel's net/sched code: sch_qfq now avoids freeing an existing class in qfq_change_class() unless a new class and qdisc are allocated, preventing potential use-after-free (UAF). The Ubuntu/Ubuntu USN and SUSE SUSE-SU-2026:1305-1 advisories list t...

CVE-2026-23410

CVE-2026-23410 – Linux kernel (AppArmor) race condition has a documented use-after-free in rawdata handling. The issue occurs when rawdata inodes aren’t refcounted, allowing an attacker to open a rawdata file while the last reference is removed (e.g., via profile removal), freeing the aa_loaddata...

CVE-2026-31661

The CVE-2026-31661 issue affects the Linux kernel brcmsmac Wi‑Fi driver where dma_free_coherent() may free a size different from what dma_alloc_consistent() allocated (size may change for alignment). The fix changes the free size to the allocation size. Descriptions across multiple advisories (NV...

CVE-2026-43163

Impact: Linux kernel md/bitmap component vulnerable to a use-after-free race during array resize, causing a General Protection Fault in write_page. Root cause: concurrent access to bitmap->storage.filemap between bitmap_daemon_work() and __bitmap_resize(), with md_bitmap_file_unmap() freeing s...

CVE-2026-46274

CVE-2026-46274 (Linux kernel, io_wq) has concrete details: a bug in io_wq_remove_pending() allowed a non-hashed predecessor to be treated as hashed, causing a stale pointer in wq->hash_tail[] to persist and be dereferenced by future hashed bucket-0 enqueues. The root cause is that io_get_work_...

CVE-2026-46281

CVE-2026-46281 affects the Linux kernel vmalloc path used by vrealloc when a new allocation is forced (wrong NUMA node or alignment). The code copies old_size bytes into a newly allocated buffer of size bytes during a shrink request, which can cause an out-of-bounds write. The fix bounds the copy...

CVE-1999-0257

CVE-1999-0257 corresponds to the Nestea variation of the teardrop IP fragmentation denial-of-service attack. The connected documents consistently describe a network DoS via IP fragmentation handling, without citing concrete affected products, versions, or a confirmed remediation patch within the ...

CVE-2002-1571

CVE-2002-1571 affects the Linux 2.4 kernel pre-2.4.19. The root cause is that the fninit instruction is assumed to clear all registers, which can cause an information leak on processors that do not clear all relevant SSE registers. The practical impact is potential leakage of information (partial...

CVE-2005-3808

The CVE-2005-3808 issue affects the Linux kernel (versions 2.6.11–2.6.14). A 32‑bit system executing 64‑bit mmap calls can trigger an integer overflow in invalidate_inode_pages2_range, allowing local users to cause a denial of service (hang). Multiple advisories confirm the vulnerability across d...

CVE-2006-1859

CVE-2006-1859 is a memory leak in the Linux kernel before 2.6.16.16, caused by a flaw in __setlease() within fs/locks.c. This leak can be exploited by a local attacker to cause a Denial of Service by consuming kernel memory. Multiple connected advisories reiterate the same root cause and link it ...

CVE-2006-3635

CVE-2006-3635 concerns the Linux kernel ia64 subsystem prior to 2.6.26. The vulnerability arises from mishandling of invalid Register Stack Engine (RSE) state, enabling a local attacker to trigger a denial of service through stack consumption, potentially crashing the system. The issue is limited...

CVE-2007-3720

The CVE-2007-3720 entry describes a vulnerability in the Linux kernel 2.4 process scheduler that uses CPU billing from periodic sampling ticks. This design allows local users to cause a denial of service (CPU consumption) by calling voluntary nanosecond sleeps, making the process inactive during ...

CVE-2008-0163

The CVE affects Linux kernel 2.6 in vserver setups, where a symlink issue in /proc allows local attackers to access resources across vservers (CVE-2008-0163). Public advisories confirm affected packages and indicate fixes: Debian DSA-1494-1/2 address linux-2.6 vulnerabilities and upgrade to a pat...

CVE-2009-1243

The issue affects the Linux kernel prior to 2.6.29.1, where an unlocking step in the udp seq_file infrastructure can be triggered under certain conditions. This allows local users to cause a denial of service (panic) by reading zero bytes from /proc/net/udp (and unspecified other files). Root cau...

CVE-2009-4306

CVE-2009-4306 concerns the Linux kernel’s ext4 filesystem, specifically the EXT4_IOC_MOVE_EXT (move extents) ioctl in 2.6.32-git6 and earlier. The vulnerability enables local users to trigger a denial of service through filesystem corruption via unknown vectors, and is described as distinct from ...

CVE-2016-8459

CVE-2016-8459 (Android) describes a possible buffer overflow in the storage subsystem, triggered by bad parameters in RPMB listener responses. The issue affects Android kernel 3.18 and is associated with the RPMB command handling, potentially leading to a write/overflow condition in kernel memory...

CVE-2016-8466

CVE-2016-8466 is an elevation of privilege vulnerability in the Broadcom Wi‑Fi driver affecting Android with kernel components (Kernel-3.10, Kernel-3.18). The issue allows a local malicious application to execute arbitrary code in the kernel context after compromising a privileged process. The en...

CVE-2017-0454

CVE-2017-0454 is an elevation-of-privilege vulnerability in the Qualcomm audio driver that allows a local malicious application to execute arbitrary code in the kernel context. Affected product: Android with kernel versions 3.10 and 3.18. Root cause is exploitation within the Qualcomm audio drive...

CVE-2017-0521

CVE-2017-0521 is a local elevation-of-privilege issue in the Qualcomm camera driver that could allow a malicious local app to execute arbitrary code in the kernel. The vulnerability targets Android and is tied to kernel versions 3.10 and 3.18, with referenced impact described as high for a compro...

CVE-2017-0574

CVE-2017-0574 describes an elevation-of-privilege vulnerability in the Broadcom Wi‑Fi driver on Android. The issue could allow a local malicious application to execute arbitrary code in the kernel context by exploiting the Wi‑Fi driver, with the Android platform and kernel versions specified as K...

CVE-2017-5548

The CVE-2017-5548 issue affects the Linux kernel 4.9.x up to 4.9.5, where drivers/net/ieee802154/atusb.c interacts with CONFIG_VMAP_STACK. This can allow local users to cause a denial of service (system crash or memory corruption) or other impact by using more than one virtual page for a DMA scat...

CVE-2019-12818

CVE-2019-12818 affects the Linux kernel prior to 4.20.15. The issue is in the NFC LLCP code: nfc_llcp_build_tlv in net/nfc/llcp_commands.c may return NULL, and if the caller neglects to check, a NULL pointer dereference can occur, leading to denial of service. The vulnerability impacts nfc_llcp_b...

CVE-2022-48750

Summary (CVE-2022-48750): The issue is in the Linux kernel hwmon driver for the nct6775 (clear_caseopen). It can crash with a NULL pointer dereference when clearing the chassis intrusion alarm, as the code path passes the hwmon device (not the platform device) and the platform data isn’t set. The...

CVE-2022-48888

CVE-2022-48888 (Linux kernel) affects the drm/msm/dpu path; the root cause is a memory leak in msm_mdss_parse_data_bus_icc_path. of_icc_get() allocated resources for path1 and may leak it if an early return occurs due to IS_ERR_OR_NULL(path0). The patch defers obtaining path1 to prevent the leak ...

CVE-2022-48894

In the Linux kernel, CVE-2022-48894 affects the iommu/arm-smmu-v3 path. The issue arises from unregistering IOMMU groups during shutdown via iommu_device_unregister(), which can cause NULL pointer dereferences in DMA API calls due to uncoordinated shutdown of devices. The documented fix changes s...

CVE-2022-49423

Summary: CVE-2022-49423 relates to the Linux kernel where RTLA tracing could dereference a NULL record in several tracing tools. Root cause (as documented): NULL pointer dereference of the variable record in multiple files (osnoise_hist.c, osnoise_top.c, timerlat_hist.c, timerlat_top.c) before ca...

CVE-2022-49758

The CVE-2022-49758 entry concerns a Linux kernel issue in the uniphier-glue path where a call to resource_size(res) may dereference NULL if platform_get_resource() returns NULL. This is a local, low-privilege issue with high availability impact as described in the CVE (CVSS: AV:L/AC:L/PR:L/UI:N/S...

CVE-2022-49791

The CVE-2022-49791 entry is about a Linux kernel issue in io_uring where a multishot accept request can leak if REQ_F_POLLED is set and the code misclassifies the operation as multishot from the polling path. The problem could lead to leaking the request by a skip-completion path, and the remedia...

CVE-2022-49852

Summary (CVE-2022-49852) : In the Linux kernel (riscv), thread_struct::s[12] may leak random kernel memory to userspace, exposing confidential data and impacting availability. The fix clears s[12] in thread_struct during fork, and it is advised to also clear s[12] for kthread cases. Affected: Lin...

CVE-2024-38631

The CVE-2024-38631 entry concerns the Linux kernel vulnerability in iio: adc: PAC1934 where an out-of-bounds array index could affect average current/voltage measurements. The hardware device supports 4 channels, but sysfs exposes additional “fake” channels for averages, which is the root cause. ...

CVE-2024-42233

CVE-2024-42233 concerns a Linux kernel memory-management issue in filemap_fault_recheck_pte_none() where vmf->ptl could be stale after a pte_unmap(), potentially allowing page-table races. The fix is to replace pte_offset_map() with pte_offset_map_nolock(), removing reliance on PTL for protect...

CVE-2024-43878

CVE-2024-43878 — Linux kernel xfrm: Fix input error path memory access . Affected component: the Linux kernel networking/xfrm stack (xfrmi_rcv_cb). Root cause: memory access during the input slow-path handling when input state is misconfigured, leading to a KASAN wild-memory-access read (observed...

CVE-2024-56612

CVE-2024-56612 describes a Linux kernel vulnerability in mm/gup where unpin_user_pages() may dereference NULL pages in the pages** array when using pofs. The flaw was triggered by a configuration like x86 with numa=fake=2 movablecore=4G on Linux 6.12, leading to a kernel NULL pointer dereference ...

CVE-2024-58022

CVE-2024-58022 relates to a NULL vs IS_ERR() handling bug in the Linux kernel’s mailbox th1520 path. The vulnerable code used to treat NULL returns from devm_ioremap() as errors consistent with IS_ERR() checks, which is incorrect since devm_ioremap() returns NULL on failure. The fixed description...

CVE-2024-58239

The CVE-2024-58239 issue affects the Linux kernel TLS path: if a non-DATA record is present in the rx_list and another of the same type remains in the queue, records can be merged and processing may exit mid-loop. The fix, described in the advisory, is to check the record type and jump to the end...

CVE-2025-38036

The CVE-2025-38036 entry describes a Linux kernel issue in drm/xe/vf where GuC communication required GT MMIO to be initialized. Root cause: gt->mmio was initialized late due to recent refactoring, causing GuC calls to xe_mmio_read|write() to crash with an NPD when attempting to access MMIO ad...

CVE-2025-38038

CVE-2025-38038 affects the Linux kernel, specifically the cpufreq/amd-pstate implementation. The issue arises from an unnecessary driver-wide mutex in set_boost for per-policy calls, creating a potential deadlock with status_store mutex_acquire in the mode-switch path. SUSE’s openSUSE-SU-2025-200...

CVE-2025-38042

CVE-2025-38042 concerns the Linux kernel DMA engine for TI k3-udma-glue. The issue stems from relying on the skip_fdq argument in k3_udma_glue_reset_rx_chn(); on some platforms there is a single FDQ for all RX flows, while others have a separate FDQ per flow. The fix infers FDQ behavior from the ...

CVE-2025-38242

In CVE-2025-38242, Linux kernel mm/userfaultfd: fix race between userfaultfd_move and swap cache. The description documents two race types: a) a BUG_ON when filemap lookup returns NULL and folio is added to the swap cache, and b) a race where a folio is changed after lookup causing RSS counter co...

CVE-2025-38524

CVE-2025-38524 concerns the Linux kernel, in net/rxrpc/recvmsg.c, where a race between concurrent recvmsg handlers can occur when a call with a queued event is processed by a thread and later requeued by another thread while holding the user_mutex. This can lead to a second thread operating on a ...

CVE-2025-38572

CVE-2025-38572 affects the Linux kernel IPv6 path, where an attacker could craft IPv6 extension headers to overflow skb->transport_header via ipv6_gso_segment() when processing very long headers. The root cause is related to the 16-bit transport header field handling, with a suggested fix addi...

CVE-2025-38574

CVE-2025-38574 affects the Linux kernel PPTP transmit path (pptp_xmit). A missing bound check on skb length could allow reading uninitialized data in pptp_xmit(), similar to changes made for ppp_sync_txmunge. The issue is fixed by the upstream commit aabc6596ffb3 and related bound-checking change...

CVE-2025-38616

CVE-2025-38616 (Linux kernel TLS ULP issue) affects the kernel TLS path handling data that may disappear from under the TLS ULP when the socket reader predated TLS installation or uses non-standard read APIs. The bug could lead to an out-of-bounds read or TLS state corruption if data is partially...

CVE-2026-45892

CVE-2026-45892 affects the Linux kernel ext4 extent handling. The issue occurs when splitting an unwritten extent in the middle with EXT4_EXT_MAY_ZEROOUT and EXT4_EXT_DATA_VALID2, potentially leaving a stale unwritten extent in the extent status tree after maps are updated. The mitigation is a pa...

CVE-2026-46020

CVE-2026-46020 affects the Linux kernel DAMON subsystem. The issue arises from unvalidated damos_quota_goal->nid for node_mem_{used,free}_bp, which is used by si_meminfo_node() and NODE_DATA(), potentially enabling out-of-bounds memory access via DAMON_SYSFS. The provided patch series mm/damon...

CVE-2026-46052

The CVE-2026-46052 issue concerns the Linux kernel Ceph filesystem where a negative dentry that is already hashed can be re-added to the dcache, corrupting the d_hash bucket and leading to an RCU stall or system hang. The root cause is that d_add() can rehash and reinstate a dentry that is alread...