CVE-2006-1860

CVE-2006-1860 affects the Linux kernel up to and including 2.6.16.15, with the fix released in 2.6.16.16. The issue is in lease_init (fs/locks.c) where a lock could be freed that might not have been allocated on the stack, allowing a local attacker to cause a denial of service (fcntl_setlease loc...

CVE-2008-2148

CVE-2008-2148 affects the Linux kernel: UTIME_NOW/UTIME_OMIT handling in sys_utimensat in 2.6.22 and older than 2.6.25.3 allows a local user to modify the timestamps of arbitrary files, potentially causing a denial of service. The root cause is improper permission checks for certain UTIME_NOW/UTI...

CVE-2011-4916

CVE-2011-4916 affects the Linux kernel up to version 3.1, where local users could access /dev/pts/ and /dev/tty* to obtain sensitive keystroke information. The available connected sources (OSV/DEBIAN/NVD-style entries) confirm the local-priority impact but do not provide specific patch versions o...

CVE-2012-6536

CVE-2012-6536 affects the Linux kernel (up to version 3.6) in net/xfrm/xfrm_user.c. The vulnerability stems from not verifying that the Netlink message length matches a header field, enabling local users with CAP_NET_ADMIN to read sensitive kernel heap memory by supplying a (1) new or (2) updated...

CVE-2013-1956

The CVE-2013-1956 issue affects the Linux kernel prior to 3.8.6, where create_user_ns in kernel/user_namespace.c may bypass filesystem restrictions by not verifying that a chroot directory differs from the namespace root during a crafted clone system call. This violation could allow local users t...

CVE-2013-3237

CVE-2013-3237 affects the Linux kernel’s vsock_stream_sendmsg in net/vmw_vsock/af_vsock.c, where a length variable is not initialized prior to use. This can allow local users to read sensitive data from kernel stack memory via crafted recvmsg/recvfrom syscalls. The issue is linked to the kernel v...

CVE-2013-4127

CVE-2013-4127 is a use-after-free in the Linux kernel's vhost_net_set_backend (drivers/vhost/net.c) up to and including version 3.10.3, enabling local attackers to trigger a denial of service (OOPS and system crash) by powering on a virtual machine. The connected Nessus advisories (Unity Linux se...

CVE-2013-4512

CVE-2013-4512 describes a buffer overflow in the Linux kernel's user-mode Linux port, specifically in the write method of /proc/exitcode (exitcode_proc_write) in arch/um/kernel/exitcode.c, exploitable by local attackers with sufficient privileges. The vulnerability exists in kernels prior to 3.12...

CVE-2016-8425

CVE-2016-8425 affects the NVIDIA Tegra kernel driver (NVHOST). The issue is a use-after-free in memory handling that can allow a local unprivileged process to escalate to the kernel, potentially enabling arbitrary code execution or denial of service. Exploitation status is not provided in the sup...

CVE-2016-8430

CVE-2016-8430 affects the NVIDIA Tegra kernel driver (NVHOST) on Android, where a mismanaged memory reference (user-after-free) can let a local attacker cause a denial of service or escalate to kernel code execution. The issue is described as elevation of privilege with potential for local persis...

CVE-2017-0325

CVE-2017-0325 affects the NVIDIA kernel driver’s i2c-hid component on Android. The issue allows an attacker to escalate privileges and execute arbitrary code in the kernel context by writing arbitrary data to an arbitrary location within i2c-hid. The vulnerability is local and requires interactio...

CVE-2017-0455

CVE-2017-0455 is an information-disclosure vulnerability in the Qualcomm bootloader that could allow a local malicious app to execute arbitrary code within the bootloader context on affected Android devices (Kernel 3.18). CNVD/OSV entries tie it to Google Pixel devices (Pixel/Pixel XL); Nessus no...

CVE-2017-0516

CVE-2017-0516 is described as an elevation of privilege in the Qualcomm input hardware driver that could enable a local malicious app to execute code in the kernel context on Android devices. Public sources consistently list affected products as Android with kernel versions 3.10 and 3.18; Android...

CVE-2017-0575

An elevation of privilege vulnerability exists in the Qualcomm Wi‑Fi driver on Android. CVE-2017-0575 can allow a local attacker to execute arbitrary code in the kernel context after compromising a privileged process. Affected products/versions include Android with the kernel versions 3.10 and 3....

CVE-2017-0613

CVE-2017-0613 is a local elevation-of-privilege flaw in the Qualcomm Secure Execution Environment Communicator driver affecting Android, enabling a non-privileged, user-space process to gain arbitrary code execution in the kernel if a privileged process is first compromised. Affected kernel versi...

CVE-2017-13686

The CVE-2017-13686 entry concerns Linux kernel versions 4.13-rc1 through 4.13-rc6, where net/ipv4/route.c does not correctly check the fi field when RTM_F_FIB_MATCH is set. This can allow a local attacker to trigger a NULL pointer dereference (denial of service) or potentially other unspecified i...

CVE-2017-8068

CVE-2017-8068 affects the Linux kernel 4.9.x before 4.9.11, where drivers/net/usb/pegasus.c interacts incorrectly with CONFIG_VMAP_STACK. This enables a local attacker to trigger a denial of service or memory corruption by exploiting use of more than one virtual page for a DMA scatterlist. The is...

CVE-2021-47279

CVE-2021-47279 affects the Linux kernel in the USB subsystem (usb: misc: brcmstb-usb-pinmap). The root cause is missing validation of the resource pointer returned by platform_get_resource(), which can lead to a null-ptr-deref. The vulnerability is resolved in the kernel by adding a check of the ...

CVE-2022-48871

In CVE-2022-48871, the Linux kernel fix targets tty: serial: qcom-geni-serial slab-out-of-bounds on the RX FIFO buffer. The probe allocates port->rx_fifo using a default depth (e.g., 16); during serial startup, port->rx_fifo_depth is updated to match device capabilities (e.g., 32). The RX U...

CVE-2022-48882

CVE-2022-48882: In the Linux kernel, a macsec null-dereference could occur in the net/mlx5e hw-offload path when updating a SecY with extended packet number (epn) enabled. The macsec SA initialization would fetch salt and ssci from the rx_sa context, which may be unavailable during SecY property ...

CVE-2022-48886

The CVE-2022-48886 issue affects the Linux kernel ice subsystem and is due to not validating kzalloc return, allowing NULL pointer dereference. The fix adds a return-value check for kzalloc and uses a goto-label for cleanup to share code paths. Connected advisories (SUSE/SU-2024:3209-1, SUSE/SU-2...

CVE-2022-49018

CVE-2022-49018 involves a Linux kernel bug where a sleep in atomic context occurred during mptcp_close. The CVE entries in the provided documents confirm the issue was resolved by replacing the fast socket lock variant with sock_lock_nested() in the mptcp_close path (net/mptcp/protocol.c: close f...

CVE-2022-49798

CVE-2022-49798 describes a race in the Linux kernel tracing eprobes where the event’s triggers could be invoked before the event record is populated, risking a NULL dereference. This is caused by a flag set for eprobes after enabling the eprobe, potentially triggering at the start of the event wh...

CVE-2023-20716

CVE-2023-20716 concerns the wlan component in MediaTek chips, where an out-of-bounds write occurs due to a missing bounds check in the WLAN driver. This can lead to local escalation of privileges with System execution rights, and no user interaction is required. Reported patch: ALPS07796883 (Issu...

CVE-2023-52982

CVE-2023-52982 affects the Linux kernel fscache path for relinquished volumes. The root cause is a mismatch between wake_up_bit() and wait_var_event() on different wait-queues, which could prevent a waiter from waking and cause a hang if wake-ups are delayed. The fixes described in the sources sw...

CVE-2024-38631

The CVE-2024-38631 entry concerns the Linux kernel vulnerability in iio: adc: PAC1934 where an out-of-bounds array index could affect average current/voltage measurements. The hardware device supports 4 channels, but sysfs exposes additional “fake” channels for averages, which is the root cause. ...

CVE-2024-46699

CVE-2024-46699: In the Linux kernel, drm/v3d preemption was not disabled around the write_seqcount_begin/end() used to update GPU stats, risking seqcount/RCU race conditions. Root cause: missing __seqprop_assert around the update path in v3d stats code leading to potential data corruption under p...

CVE-2024-46769

CVE-2024-46769 relates to the Linux kernel SPI Intel driver. A check for the pointer returned by devm_kasprintf() in intel_spi_populate_chip() was missing, allowing a NULL pointer to be used for pdata->name. The vulnerability has been resolved in the kernel with the fix described in the linked...

CVE-2025-38172

CVE-2025-38172 refers to a Linux kernel vulnerability in the erofs filesystem driver where a device-type mismatch between primary and extra devices can trigger a use-after-free (UAF). The root cause, as described in the advisory, is that when the primary device is a block device and the extra dev...

CVE-2025-38254

The CVE-2025-38254 issue is in the Linux kernel (drm/amd/display) where drm_edid_raw() could return NULL or oversized EDID bytes, risking an Oops or memory corruption. The fix adds sanity checks for drm_edid_raw() and returns EDID_BAD_INPUT in those corner cases. It is related to EDID handling wh...

CVE-2025-38329

CVE-2025-38329 – Linux kernel: firmware: cs_dsp: fixes OOB memory read in KUnit test (wmfw info). KASAN reported out-of-bounds access in cs_dsp_mock_wmfw_add_info() where source string length was rounded up to the allocation size. Impact: local attacker with LOW privileges; confidentiality and av...

CVE-2025-38405

CVE-2025-38405 concerns the Linux kernel component nvmet, where a memory leak in bio integrity (bio->bi_integrity) can occur when commands with metadata are processed. The underlying cause is that, after the commit bf4c89fc8797, all users of bio_init must also call bio_uninit to ensure proper ...

CVE-2025-38538

CVE-2025-38538 : In the Linux kernel DMA engine nbpfaxi, memory corruption could occur due to out-of-bounds access in nbpf_probe() where nbpf->chan[] is allocated with num_channels elements but three loops could index one past the end. The second loop copies data from irqbuf[] to nbpf->chan...

CVE-2025-38582

CVE-2025-38582 affects the Linux kernel RDMA/hns (hns_roce) stack. The root cause is a double destruction of rsv_qp: free_mr_init() can run twice (once in free_mr_init() during error flow and again in hns_roce_exit()), leading to LIST_POISON1 corruption in the qP destroy path. The fix moves the f...

CVE-2025-38601

Mode C: The CVE-2025-38601 entry concerns the Linux kernel, specifically the ath11k/ srng handling. The root cause described across sources is that after two crash/recovery cycles, ath11k_hal_srng_deinit() destroys srng lists but does not reset per-list ->initialized flags. A subsequent call t...

CVE-2026-23060

The CVE-2026-23060 issue in the Linux kernel crypto: authencesn module arises when assoclen

CVE-2026-23149

Summary: CVE-2026-23149 affects the Linux kernel DRM subsystem, specifically drm_gem_change_handle_ioctl(). The vulnerability arises because GEM buffer object handles are u32 in the user API while internal idr_alloc() uses int ranges, causing a kernel warning (WARN_ON_ONCE) when a handle larger t...

CVE-2026-23226

CVE-2026-23226 involves a kernel vulnerability in ksmbd where the ksmbd_chann_list xarray was lacking synchronization, allowing a use-after-free in multi-channel sessions between lookup_chann_list() and ksmbd_chann_del. The provided documents confirm the root cause and the fix: the patch adds a n...

CVE-2026-23278

CVE-2026-23278 (Linux kernel nf_tables catchall handling) The issue occurs in netfilter nf_tables where, during transaction processing, a map holding catchall elements being removed may require toggling all pending catchall elements, not just the first viable candidate. If the map is also being f...

CVE-2026-31657

CVE-2026-31657 affects the Linux kernel batman-adv component. The flaw arises when batman-adv’s batadv_bla_add_claim() can replace claim->backbone_gw and drop the old gateway’s final reference while readers still follow the pointer. The netlink claim dump path dereferences claim->backbone_g...

CVE-2026-31661

The CVE-2026-31661 issue affects the Linux kernel brcmsmac Wi‑Fi driver where dma_free_coherent() may free a size different from what dma_alloc_consistent() allocated (size may change for alignment). The fix changes the free size to the allocation size. Descriptions across multiple advisories (NV...

CVE-2026-43013

Technical details for CVE-2026-43013 are not publicly available in the provided connected documents. Monitor for updates from vendors/security trackers.

CVE-2026-43049

CVE-2026-43049 affects the Linux kernel HID logitech-hidpp driver (Logitech G920 force feedback). If force feedback init fails, resources may be torn down inconsistently, enabling a use-after-free (UAF) if userspace still references dangling objects. The fixed approach chose to warn but return su...

CVE-2026-45892

CVE-2026-45892 affects the Linux kernel ext4 extent handling. The issue occurs when splitting an unwritten extent in the middle with EXT4_EXT_MAY_ZEROOUT and EXT4_EXT_DATA_VALID2, potentially leaving a stale unwritten extent in the extent status tree after maps are updated. The mitigation is a pa...

CVE-2026-46115

In the Linux kernel block subsystem, CVE-2026-46115 was addressed by adding a check so that zone_device_pages_have_same_pgmap() prevents merging bvec segments that span different dev_pagemaps in biovec_phys_mergeable. Root cause: biovec_phys_mergeable() did not verify that two physically contiguo...

CVE-2026-46322

The CVE relates to the Linux kernel tun driver vulnerability CVE-2026-46322. When build_skb() fails inside tun_xdp_one(), the function returns -ENOMEM without freeing the allocated page for the frame, causing a memory leak of one page-frag chunk per failed build_skb() in a batch. The root cause i...

CVE-2026-64257

CVE-2026-64257 affects the Linux kernel SMB2 client logic. The issue arose from overlap handling in __smb2_calc_size(), where clearing data_length could cause an invalid SMB2 response to appear as if it has no data area, allowing an unintended length-exemption path. The fix tracks data area overl...

CVE-1999-0216

The CVE-1999-0216 entry concerns a Denial of Service of inetd on Linux triggered by SYN and RST packets. Connected documents consistently describe inetd on Linux as the affected component and the root cause as crafted TCP packets causing denial of service. Public details in the PT-1997-1097 entry...

CVE-2001-1390

The CVE-2001-1390 entry concerns an unknown vulnerability in the Linux kernel component binfmt_misc prior to version 2.2.19, related to user pages. Connected advisories (Mandrake MDKSA-2001:037 and Debian DSA-047-1, among others) document that the core issue is an off-by-one error in the CPIA dri...

CVE-2001-1392

The supplied documents confirm CVE-2001-1392 affects the Linux kernel prior to 2.2.19, due to missing unregister calls for CPUID and MSR drivers, which could crash the system on unloading/loading (local DoS). Remediation is to upgrade to kernel 2.2.19 or later (as noted in Mandrake/Debian/NVD ref...