CVE-2024-58059

In CVE-2024-58059, the vulnerability is in the Linux kernel’s media/uvcvideo code. The deadlock could occur when uvc_probe() fails and ends up calling uvc_status_unregister() before uvc_status_init(), risking synchronization issues in the status handling path. The confirmed fix guards against thi...

CVE-2025-38029

CVE-2025-38029 (Linux kernel) : The issue occurs in kasan when apply_to_pte_range enters lazy MMU mode and invokes kasan_populate_vmalloc_pte(), which can sleep while allocating a single page. This can crash in-context on certain arches (e.g., s390) when preemption is manipulated during lazy MMU ...

CVE-2025-38134

CVE-2025-38134 in Linux kernel: The usb: acpi: fix prevents a NULL pointer dereference in usb_acpi_add_usb4_devlink() due to usb_hub_to_struct_hub() returning NULL in certain hub teardown scenarios. The issue could lead to an access to hub->ports[...] if NULL, and was mitigated by guards in ot...

CVE-2025-38208

CVE-2025-38208 is resolved in the Linux kernel: smb client adds a NULL check in automount_fullpath to prevent NULL dereference when tcon->origin_fullpath is set. The issue was a missing null check in __build_path_from_dentry_optional_prefix for the case when origin_fullpath is present. Affects...

CVE-2025-38284

CVE-2025-38284 affects the Linux kernel wifi driver rtW89 via PCI config DAC handling. The issue: 36-bit DMA support depends on a chip‑proprietary bit accessible through PCI config API or DBI; when mmap is NULL, a page fault occurs and the kernel trace shows a BUG in rtw89_pci_ops_write16 leading...

CVE-2025-38306

CVE-2025-38306 concerns the Linux kernel. It describes a race in fs/fhandle.c where may_decode_fh() can call has_locked_children() without holding locks, enabling an oopsable race. The fix renames has_locked_children() to __has_locked_children(), makes it static, and updates callers in fs/namespa...

CVE-2025-38540

CVE-2025-38540 relates to the Linux kernel HID quirk handling for two Chicony Electronics HP 5MP Cameras (USB IDs 04F2:B824 and 04F2:B82C). The vulnerability arises because the HID sensor interface is non-functional by design, and attempting to access it via iio_info can cause the system to hang ...

CVE-2025-38550

CVE-2025-38550 is a Linux kernel issue in ipv6 multicast handling. The root cause is delaying the release of the reference to pmc->idev in mld_del_delrec(), while pmc->idev is also used by ip6_mc_clear_src(). The fix (as stated) is to put the reference after ip6_mc_clear_src() returns. The ...

CVE-2025-38571

CVE-2025-38571 is a Linux kernel vulnerability affecting sunrpc/NFS over TLS. The issue arises from the client-side handling of TLS alerts in tls_alert_recv, caused by an assumption that the msghdr iterator’s kvec contains valid data. The patch reworks how control messages are set up and used by ...

CVE-2025-38590

CVE-2025-38590: In the Linux kernel mlx5e IPsec offload path, if the decrypted xfrm state is not found, the secpath on the skb may remain and be dereferenced by __xfrm_policy_check(), causing a crash. The documented fix explicitly removes the skb secpath when the xfrm state lookup fails after har...

CVE-2025-38734

Summary (CVE-2025-38734): Affected component is Linux kernel net/smc. The vulnerability stems from a use-after-free risk where newclcsock->sk may be NULL after smc_listen_out_connected() releases smcsk. If a user app closes the accepted socket immediately after accept(), the code path can dere...

CVE-2026-23004

The CVE-2026-23004 issue in the Linux kernel concerns races in the IPv6 dst cache path (rt6_uncached_list_del/rt_del_uncached_list) leading to use-after-free during list_head initialization in INIT_LIST_HEAD, as observed by KASAN in rt6_uncached_list_flush_dev and related paths. The root cause is...

CVE-2026-23231

CVE-2026-23231 affects the Linux kernel nf_tables code. The root cause is a use-after-free in nf_tables_addchain(), where a new chain is published to a table via list_add_tail_rcu() before hooks are registered; on failure the error path frees the chain without an RCU grace period, creating use-af...

CVE-2026-31636

Summary: CVE-2026-31636 affects the Linux kernel rxrpc subsystem. The root cause is in rxgk_verify_authenticator(), which copies auth_len into a temporary buffer and then uses p + auth_len as the parser limit. Because p is a __be32*, this inflates the parser end pointer by four, enabling a slab-o...

CVE-2026-43226

The CVE-2026-43226 issue affects the Linux kernel Reliable Datagram Sockets (RDS). A state-machine bug allowed an RDS_CONN_ERROR to bypass the proper shutdown path via a shortcut through RDS_CONN_CONNECTING, created by RDS/TCP multipath changes. This could leave a connection stuck in shutdown-que...

CVE-2026-46150

The CVE-2026-46150 issue affects the Linux kernel fanotify subsystem. It arises because fsnotify_get_mark_safe() may return false for a mark in an unrelated group, bypassing the permission check. The fix patches the logic to skip detached marks that are not in the current group, mitigating the by...

CVE-2026-46180

CVE-2026-46180 concerns a use-after-free in wifi brcmfmac when stopping the watchdog task in the Linux kernel. The vulnerability is addressed by increasing the watchdog task reference count before send_sig() and then dropping it with kthread_stop_put(). Connected OSV entries show patches in Root:...

CVE-2026-46306

CVE-2026-46306 — Linux kernel PPPoE PFC flow-dissector fix The vulnerability affects the Linux kernel flow dissector for PPPoE when handling Protocol Field Compression (PFC) frames. A compressed 1-byte Protocol Field can shift the PPP payload by one byte, causing a 4-byte misalignment in the netw...

CVE-2026-53361

The CVE-2026-53361 vulnerability affects the Linux kernel, specifically af_unix code in unix_gc() where gc_in_progress could be observed as false during scheduling, potentially allowing a sequence where gc_in_progress is not reliably set. The root cause is the race between unix_schedule_gc() and ...

CVE-1999-0401

CVE-1999-0401 describes a race condition in Linux kernel 2.2.1 that allows local users to read arbitrary memory from /proc files. The vulnerability arises from a race in the /proc handling in Linux 2.2.1, enabling partial/possible disclosure of memory contents to unprivileged local users. Affecte...

CVE-1999-0804

CVE-1999-0804 affects Linux 2.2.x kernels, where the vulnerability lies in ICMP handling. Malformed ICMP packets with unusual types, codes and IP header lengths can cause a denial of service. The NVD CVSS v2 base score is 5.0 (Medium), with network attack vector, low attack complexity, and partia...

CVE-2000-0227

The CVE-2000-0227 entry concerns the Linux 2.2.x kernel where the number of Unix domain sockets is not restricted by the wmem_max parameter. This allows a local attacker to cause a denial of service by requesting a large number of sockets. The linked sources confirm the affected platform and vuln...

CVE-2001-1400

CVE-2001-1400 describes a local denial-of-service issue in the Linux kernel before 2.2.19 where UDP port allocation could deadlock a system. Connected advisories confirm the vulnerability affects the Linux kernel up to 2.2.18 and are corrected in the 2.2.19 release (e.g., Mandrake MDKSA-2001:037 ...

CVE-2004-0997

CVE-2004-0997 is a local privilege-escalation vulnerability in the MIPS ptrace assembly code of the Linux kernel 2.4.x prior to 2.4.17. The connected Debian advisories (DSA-1067-1 and DSA-1070-1) reference this CVE among a list of kernel vulnerabilities and indicate remediation via updates to ker...

CVE-2005-3753

CVE-2005-3753 affects the Linux kernel in the 2.6.x line, around versions near 2.6.12 up to 2.6.13.1. The issue could allow a denial of service (an Oops) via certain IPSec packets that trigger alignment problems in standard multi-block cipher processors. The description notes it is not clear whet...

CVE-2005-4635

CVE-2005-4635 affects the Linux kernel via nl_fib_input in fib_frontend.c, where lack of validation for header and payload lengths allows remote attackers to trigger a denial of service (invalid memory reference) with malformed fib_lookup netlink messages. Affected lineage is kernels before 2.6.1...

CVE-2006-0035

The CVE-2006-0035 entry is supported by connected documents detailing a vulnerability in the Linux kernel (versions 2.6.14 and 2.6.15). The issue occurs in the netlink_rcv_skb function within af_netlink.c, where a crafted nlmsg_len field of 0 can cause a local-user-triggered denial of service via...

CVE-2009-3043

The CVE-2009-3043 entry affects Linux kernel 2.6.31-rc before 2.6.31-rc8. The tty_ldisc_hangup function in drivers/char/tty_ldisc.c allows local users to trigger a denial of service (system crash, sometimes with a NULL pointer dereference) and may enable privilege escalation via certain pseudo-te...

CVE-2016-6755

CVE-2016-6755 is an elevation-of-privilege vulnerability in the Qualcomm camera driver for Android, affecting Kernel-3.10 and Kernel-3.18. It allows a local attacker to execute arbitrary code in kernel context after compromising a privileged process. Affected devices include Nexus 5X, Nexus 6, Ne...

CVE-2016-8402

Technical details (affected components, root cause, fixes, or in-wild exploit status) for CVE-2016-8402 are not provided in the connected documents. Monitor official advisories and vendor updates for new information.

CVE-2016-8427

CVE-2016-8427 affects the NVIDIA Tegra kernel driver (NVHOST). The connected NVIDIA bulletin entry for CVE-2016-8427 notes a memory-after-free vulnerability in NVHOST that can lead to denial of service or escalation of privileges, enabling a local attacker to execute code in kernel context. The i...

CVE-2016-8438

CVE-2016-8438 describes an integer overflow in the Android kernel’s Peripheral Image Loader (PIL) path that leads to a TOCTOU condition, potentially bypassing PIL authentication. Affected product: Android (kernel 3.18). Root cause is an integer overflow exposing a race condition; impact is descri...

CVE-2016-8443

CVE-2016-8443 details (from provided documents): Android kernel 3.18 vulnerability that could allow possible unauthorized memory access in the hypervisor. The issue arises from an incorrect configuration that provides access to subsystem page tables. Affected product: Android; kernel version: 3.1...

CVE-2016-8457

CVE-2016-8457 is a vulnerability in the Broadcom Wi‑Fi driver on Android. It enables a local, malicious application to gain elevated privileges by executing arbitrary code in the kernel context. The issue requires compromising a privileged process and is classified as High severity (CVSSv3.0: Loc...

CVE-2017-0333

CVE-2017-0333 : An elevation of privilege in the NVIDIA GPU driver could allow a local malicious Android process to run arbitrary code in the kernel context on devices with Kernel-3.18. This could lead to a local permanent compromise and may require reflashing the OS to repair the device. The pro...

CVE-2017-0442

CVE-2017-0442 describes an elevation-of-privilege in the Qualcomm Wi‑Fi driver on Android, allowing a local malicious app to execute arbitrary code in the kernel context. The vulnerability, affecting Android devices with Qualcomm Wi‑Fi components, is mitigated by requiring compromise of a privile...

CVE-2017-0610

CVE-2017-0610 is a local privilege-escalation in the Qualcomm sound driver on Android, enabling a malicious local app to run arbitrary code in the kernel context. Affected software:Android kernel versions 3.10 and 3.18 with the Qualcomm sound subsystem. Root cause centers on elevation of privileg...

CVE-2017-0611

CVE-2017-0611 is an elevation of privilege in the Qualcomm sound driver on Android that could allow a local attacker to run code in kernel context. Affected: Android devices using Kernel-3.10 and Kernel-3.18 (Android ID A-35393841). The entry is listed in multiple sources (NVD/NVD list and CVE re...

CVE-2022-49819

CVE-2022-49819 concerns the Linux kernel. The issue in octeon_ep has a potential memory leak in octep_device_setup on failures of unsupported_dev or mbox init, where oct->conf was not freed and oct->mmio[i].hw_addr was not unmapped. The fix frees oct->conf with kfree() and unmaps oct-&gt...

CVE-2023-20662

The CVE-2023-20662 entry describes a vulnerability in the wlan component where an integer overflow causes an out-of-bounds write. This could enable local escalation of privilege with SYSTEM-level execution privileges and requires no user interaction. A patch is identified as ALPS07560765 (Issue A...

CVE-2023-20679

CVE-2023-20679 affects MediaTek WLAN in which a missing bounds check allows an out-of-bounds read, enabling local escalation of privilege without user interaction. Impact: confidentiality impact listed as high; privilege requirement is high with local attack vector, no UI interaction needed. Root...

CVE-2024-57991

CVE-2024-57991: Linux kernel WiFi driver rtW89 gating logic in rtw89_entity_recalc_mgnt_roles() caused a spurious soft lockup. The code’s for_each_entry loop attempted to abort only the inner loop with break; the outer loop continued, allowing the normalization to proceed and trigger a CPU stall ...

CVE-2024-57992

CVE-2024-57992 relates to the Linux kernel wi lc1000 wireless driver where a race between wiphy allocation and registration could trigger a kernel panic. The issue arises from an error path in wilc drivers (sdio and SPI) that may call wiphy_unregister on a wiphy that has not been registered, lead...

CVE-2024-58004

CVE-2024-58004 affects the Linux kernel’s media: intel/ipu6 path. The issue arises when a cpu latency QoS request is not removed on the error path, causing a corruption in the cpu latency QoS list (list_add corruption). The kernel log excerpt illustrates a corrupted list prev/next pointers during...

CVE-2024-58008

CVE-2024-58008 affects the Linux kernel in the DCP crypto driver when vmalloc stack is enabled (CONFIG_VMAP_STACK=y). The issue stems from improper use of sg_init_one() with vmalloc’d stack buffers (plain_key_blob) during encryption key processing, which can cause a crash during en- and decryptio...

CVE-2025-38269

CVE-2025-38269 affects the Linux kernel, specifically the btrfs path. When exit after a state insertion failure occurs in btrfs_convert_extent_bit(), if insert_state() fails and CONFIG_BUG is disabled, the code falls through to cache_state() and dereferences the error pointer, causing an invalid ...

CVE-2025-38322

CVE-2025-38322: Linux kernel perf/x86/intel crash fix. The issue caused a hard-lockup on Raptor Lake when perf metrics were invoked on cores not supporting perf, due to the is_topdown_event() function being used in place of is_topdown_count() during sample read after a regression introduced by co...

CVE-2025-38526

CVE-2025-38526 : In the Linux kernel, the ice driver adds a NULL check in eswitch lag validation to prevent a NULL-pointer dereference when lag->upper_netdev is NULL. The root cause was ice_lag_is_switchdev_running() being invoked outside the LAG event handler, potentially dereferencing a NULL...

CVE-2025-38601

Mode C: The CVE-2025-38601 entry concerns the Linux kernel, specifically the ath11k/ srng handling. The root cause described across sources is that after two crash/recovery cycles, ath11k_hal_srng_deinit() destroys srng lists but does not reset per-list ->initialized flags. A subsequent call t...

CVE-2025-38684

CVE-2025-38684 affects the Linux kernel’s net/sched ETS implementation. The issue arose from purging unused DRR queues during ets_qdisc_change(), where the code used the new value of q->nbands for cleanup. The fix ensures the purge uses the old values of q->nbands (and q->nstrict), so pu...