CVE-2017-5547

The CVE-2017-5547 issue affects Linux kernel 4.9.x prior to 4.9.6, specifically the drivers/hid/hid-corsair.c path. The root cause is incorrect interaction with CONFIG_VMAP_STACK, enabling a local attacker to trigger a denial of service (system crash) or memory corruption by abusing more than one...

CVE-2018-19406

CVE-2018-19406 affects the Linux kernel up to version 4.19.2, specifically kvm_pv_send_ipi in arch/x86/kvm/lapic.c. A crafted system call can reach a state where the APIC map is uninitialized, leading to a NULL pointer dereference and a BUG, causing a local denial of service. Connected advisories...

CVE-2021-47279

CVE-2021-47279 affects the Linux kernel in the USB subsystem (usb: misc: brcmstb-usb-pinmap). The root cause is missing validation of the resource pointer returned by platform_get_resource(), which can lead to a null-ptr-deref. The vulnerability is resolved in the kernel by adding a check of the ...

CVE-2022-49758

The CVE-2022-49758 entry concerns a Linux kernel issue in the uniphier-glue path where a call to resource_size(res) may dereference NULL if platform_get_resource() returns NULL. This is a local, low-privilege issue with high availability impact as described in the CVE (CVSS: AV:L/AC:L/PR:L/UI:N/S...

CVE-2022-49791

The CVE-2022-49791 entry is about a Linux kernel issue in io_uring where a multishot accept request can leak if REQ_F_POLLED is set and the code misclassifies the operation as multishot from the polling path. The problem could lead to leaking the request by a skip-completion path, and the remedia...

CVE-2022-49847

CVE-2022-49847 concerns a segmentation fault in the Linux kernel's ti_am65 cpsw Ethernet driver (am65_cpsw_nuss) during module removal. The fix changes the cleanup sequence: am65_cpsw_nuss_phylink_cleanup() is moved to run after am65_cpsw_nuss_cleanup_ndev(), ensuring phylink remains valid while ...

CVE-2022-49893

CVE-2022-49893 concerns a Linux kernel issue where the cxl/region leak occurs if a region is deleted. The fix ensures that, during unregister_region(), all targets previously assigned to the region are detached, so their references to the region drop and the region object is not leaked after sysf...

CVE-2022-50048

The CVE-2022-50048 vulnerability concerns the Linux kernel netfilter nf_tables component. The issue is a module reference underflow in the error path when nft_expr_clone() fails: dst->ops is set, but the module refcount hasn’t been bumped yet, so nft_expr_destroy() can underflow. Affected area...

CVE-2022-50161

CVE-2022-50161 is a Linux kernel vulnerability where the of_flash_probe_versatile refcount leak is fixed. The root cause is that of_find_matching_node_and_match() returns a node pointer with an incremented refcount, and the patch adds a missing of_node_put() to release it when no longer needed. D...

CVE-2023-52908

CVE-2023-52908 (Linux kernel): In drm/amdgpu, a potential NULL dereference could occur when the resource manager is NULL while printing debug information. The entry states this was fixed in the Linux kernel (drm/amdgpu: Fix potential NULL dereference). Concrete details in the connected docs point...

CVE-2023-53259

CVE-2023-53259 (Linux kernel) is a local vulnerability in VMCI where vmci_host_setup_notify() may dereference a NULL context->notify_page after get_user_pages_fast(), causing a general protection fault. The fix, as documented in the advisory, is to validate context->notify_page and return a...

CVE-2023-53292

CVE-2023-53292 (Linux kernel) describes a NULL pointer dereference in blk_mq_elv_switch_none where q->elevator may become NULL after acquiring q->sysfs_lock; the fix guards the q->elevator dereference by checking it while holding the lock, preventing a crash/local denial of service. The ...

CVE-2024-56666

In Linux kernel, drm/amdkfd: Dereference null return value in pqm_uninit occurs when pdd = kfd_get_process_device_data could be NULL and is dereferenced without NULL-checking. This is a local, low-privilege issue with MEDIUM impact per CVSS v3.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). The CVE is m...

CVE-2025-38082

CVE-2025-38082 refers to a Linux kernel vulnerability in gpio: virtuser where an out-of-bounds write could occur if a caller wrote more characters than the destination buffer could hold in simple_write_to_buffer. The issue is mitigated by a fix that truncates the input size to the available buffe...

CVE-2025-38101

CVE-2025-38101 is publicly addressed in the openSUSE/SUSE advisory for the Linux kernel. The issue concerns the ring-buffer subsystem, specifically the function ring_buffer_subbuf_order_set(), where the critical section was enlarged to ensure error handling runs with the per-buffer mutex held, pr...

CVE-2025-38269

CVE-2025-38269 affects the Linux kernel, specifically the btrfs path. When exit after a state insertion failure occurs in btrfs_convert_extent_bit(), if insert_state() fails and CONFIG_BUG is disabled, the code falls through to cache_state() and dereferences the error pointer, causing an invalid ...

CVE-2025-38503

CVE-2025-38503 : Linux kernel BTRFS vulnerability with block_group_tree enabled can trigger an assertion while rebuilding the free space tree, causing a kernel BUG and machine halt. The issue occurs when processing an empty block group (no extents/items) and a ret value of 1 is returned by btrfs_...

CVE-2025-38509

Summary of CVE-2025-38509 (Linux kernel, wifi/mac80211): A vulnerability in VHT mode notifications for sub-20 MHz channel widths (notably 5/10 MHz) could lead to invalid input reaching ieee80211_chan_width_to_rx_bw(), triggering a WARN_ON. The issue arises when VHT opmode_notif is used and unsupp...

CVE-2025-38513

CVE-2025-38513 : Linux kernel WiFi zd1211rw driver fix for a potential NULL pointer dereference in zd_mac_tx_to_dev(). The patch adds a NULL check before calling zd_mac_tx_status() to handle the race where skb = __skb_dequeue(q) can return NULL after the distance between queue-length checks and d...

CVE-2025-38520

In CVE-2025-38520, the Linux kernel’s DRM/AMDKFD path could deadlock during MMU notifier callbacks when a process exits, potentially leaking VRAM. The root cause was calling mmput from the MMU notifier callback, risking release of the mm struct and exit_mmap/free_pgtable. The fix takes a non-zero...

CVE-2025-38533

CVE-2025-38533: In the Linux kernel’s net/libwx code, the Rx buffer descriptor used two DMA addresses in wx_rx_buffer: dma and page_dma. The page_dma field was initialized and used, but dma was left uninitialized and could be used in some paths, leading to undefined behavior such as DMA errors or...

CVE-2025-38562

CVE-2025-38562 affects the Linux kernel ksmbd component. When a client performs two session setups with krb5 authentication to ksmbd, a null pointer dereference in generate_encryptionkey could occur if sess->Preauth_HashValue is NULL while the session is valid. The fix ensures the encryption k...

CVE-2025-38665

CVE-2025-38665 (Linux kernel CAN): A NULL pointer dereference in netlink can_changelink() when restarting a CAN device, due to missing can_priv::do_set_mode callback. Two code paths call this callback: manual restart via can_changelink() and delayed automatic restart after bus off. The fix preven...

CVE-2025-39700

CVE-2025-39700 concerns the Linux kernel damon migration code. According to connected advisories, damon_migrate_pages() can perform migration to an invalid target node, triggering a kernel BUG (PAGEFAULT/OOP) on local execution. The fix adds a target-node validity check in damon_migrate_pages(), ...

CVE-2025-39795

CVE-2025-39795 involves a kernel block layer (blk_stack_limits) overflow where chunk_sectors could exceed an unsigned int when interpreted in bytes. The concrete fix, documented in multiple advisories (e.g., Ubuntu USN entries and Oracle/Linux ELSA/DLA), changes the validation to operate on secto...

CVE-2025-39823

CVE-2025-39823 is a Linux kernel KVM/CPU virtualization vulnerability affecting x86 where indices from the guest (min, dest_id) were used with array_index_nospec after bounds checks. The issue enables speculative execution side-channel leakage affecting confidentiality, integrity, and availabilit...

CVE-2025-39913

CVE-2025-39913 is a Linux kernel vulnerability related to tcp_bpf: when tcp_bpf_send_verdict() fails to allocate psock->cork, the code previously could proceed silently. The patch ensures sk_msg_free() is called if the cork allocation fails and that the copied count is set to 0, preventing cor...

CVE-2025-71200

The CVE-2025-71200 entry describes a Linux kernel vulnerability in mmc: sdhci-of-dwcmshc where in HS200/HS400 timing modes lowering the clock below 52MHz could break the link due to the Rockchip DWC MSHC controller requiring a 52MHz minimum. The fix adds a check to prevent illegal clock reduction...

CVE-2026-23089

CVE-2026-23089 is a Linux-kernel issue in ALSA USB-audio: use-after-free in snd_usb_mixer_free() when mixer creation fails, causing freed mixer control memory to be referenced by callbacks during card registration. The connected advisories confirm the root cause and state the fix is to remove all...

CVE-2026-23097

CVE-2026-23097: Linux kernel migrate path deadlock due to incorrect lock ordering between hugetlb folio_lock and i_mmap_rwsem. Specifically migrate_pages -> migrate_hugetlbs -> unmap_and_move_huge_page -> remove_migration_ptes -> __rmap_walk_file() acquires i_mmap_lock_read while anot...

CVE-2026-23133

Technical details for CVE-2026-23133 are not publicly provided in the connected documents; the Ubuntu advisories reference it among others but do not expose affected product, impact, or patch specifics. Monitor for updates.

CVE-2026-23262

CVE-2026-23262 affects the Linux kernel gve driver when queue counts are changed. The NIC and driver share a region in memory for stats reporting; the NIC calculates its offset into this region using the total stats size and the NIC’s own stats size. When the queue count increases, the driver res...

CVE-2026-31554

The CVE-2026-31554 entry concerns a Linux kernel futex requeue issue: using sys_futex_requeue() with different flags could enable a use-after-free/UaF condition. To fix, the code now requires identical flags for sys_futex_requeue() (matching the behavior of old-style sys_futex() requeue). The vul...

CVE-2026-43042

The CVE-2026-43042 issue affects the Linux kernel MPLS code. It describes a race condition where concurrent operations on platform label data can yield an inconsistent view during a resize of the platform_label tables, particularly in the RCU-protected paths mpls_forward and mpls_dump_routes unde...

CVE-2026-43232

Summary: CVE-2026-43232 is a Linux kernel vulnerability in the FarSync WAN driver (net: wan: farsync) that causes a use-after-free when detaching a FarSync T-series card. The issue arises from a race between tasklets/work queues and card removal: fst_card_info is freed in fst_remove_one() but fst...

CVE-2026-45919

CVE-2026-45919 relates to Linux kernel sched/rt self-IPI loops caused by LB on CPU0. A patch fixes the issue by filtering out the initiating CPU in rto_next_cpu to prevent self-IPIs and CPU hardlockups. Public OSV entries show Root:Ubuntu patches (e.g., ROOT-OS-UBUNTU-2404-CVE-2026-45919 and ROOT...

CVE-2026-46273

The CVE-2026-46273 entry describes a Linux kernel vulnerability in the ibmveth driver affecting Power systems: GSO offload fails when MSS < 224 bytes, potentially freezing the network adapter and causing DoS until a manual reset. The fix adds an ndo_features_check to disable GSO for MSS 1; si...

CVE-2026-46296

The CVE-2026-46296 issue affects the Linux kernel driver for spi s3c64xx. Root cause: a DMA channel allocation was moved from probe() to s3c64xx_spi_prepare_transfer(), but the corresponding deallocation was not removed from the remove() path, leading to a NULL-pointer dereference on driver unbin...

CVE-2026-52982

The CVE-2026-52982 issue affects the Linux kernel driver rtl8150 for Realtek RTL8150 USB Ethernet devices. A use-after-free (UAF) can occur in rtl8150_start_xmit() when reading skb->len for tx_bytes statistics after usb_submit_urb() is issued, because the skb may be freed in the USB completion...

CVE-2026-64051

The issue is in the Linux kernel’s accel/qaic driver. A bounds check was missing in remap_pfn_range called by qaic_gem_object_mmap, allowing (re)mapping beyond the VMA when the BO is large. This can yield use-after-free if munmap() only unmaps the VMA while extra mappings remain, enabling potenti...

CVE-2026-64277

The CVE-2026-64277 issue affects the Linux kernel synaptics-rmi4 input driver. The rmi_f3a_map_gpios() path allocates gpio_key_map using min(gpio_count, TRACKSTICK_RANGE_END) (at most 6 entries), but rmi_f3a_attention() iterates the full gpio_count and dereferences gpio_key_map[i], while input-&g...

CVE-2026-64425

CVE-2026-64425 affects the Linux kernel's io_uring/io-wq subsystem. A prior fix introduced a check for IO_WQ_BIT_EXIT in the outer work run loop, but it still snapshots the exit bit once before processing an entire dependent linked-work chain. If io_wq_exit_start() sets the bit after the first li...

CVE-1999-0074

CVE-1999-0074 describes a flaw where listening TCP ports are assigned sequentially, enabling spoofing. The connected documents do not specify affected products, versions, or root cause details beyond this mechanism. Exploitation status, impact scope, and fixes are not provided; some entries reite...

CVE-2003-0643

CVE-2003-0643 involves an integer signedness error in the Linux Socket Filter (filter.c) in Linux kernels from 2.4.3-pre3 through 2.4.22-pre10, which can cause a crash (denial of service). The vulnerability is documented across multiple sources (NVD/CVE entries, Debian advisory CD/OSV). The initi...

CVE-2005-0176

The CVE-2005-0176 issue affects the Linux kernel (2.6.9 and earlier) where shmctl-based locking of System V shared memory could be misused by local unprivileged users to unlock memory from other processes. This could cause sensitive memory contents to be swapped to disk and read by others after r...

CVE-2005-1263

CVE-2005-1263 affects the Linux kernel: the elf_core_dump path in binfmt_elf.c can trigger a negative length in create_elf_tables, causing a buffer overflow that enables local attackers to execute arbitrary code. Affected: Linux kernel 2.x up to listed pre-release/rc versions across multiple line...

CVE-2005-2873

Technical details for CVE-2005-2873 are not provided in the connected documents. Available sources reference related CVEs and kernel updates but do not specify affected product/version, root cause, or remediation for this CVE.

CVE-2005-3179

CVE-2005-3179 affects the Linux kernel, specifically the drm.c path in kernel versions 2.6.10 through 2.6.13. The vulnerability arises because a debug file is created in sysfs with world‑readable and world‑writable permissions. This allows a local user to enable DRM debugging and potentially obta...

CVE-2005-3848

CVE-2005-3848 concerns a memory leak in the Linux kernel’s icmp_push_reply() that can be triggered by crafting a large number of ICMP packets, causing memory consumption and a denial of service. Public details in the initial entry specify Linux kernels before 2.6.12.6 and 2.6.13 are affected, wit...

CVE-2006-1522

CVE-2006-1522 affects Linux kernel 2.6.16.1 and 2.6.17-rc1 (and possibly earlier). The sys_add_key function in the keyring code may add a key to a user key instead of a keyring, causing an invalid dereference in __keyring_search_one and resulting in a local DoS (OOPS) / kernel crash. The vulnerab...