CVE-2006-5749

The CVE-2006-5749 issue affects the Linux kernel 2.4 series up to, but not including, 2.4.34-rc4. It concerns the isdn_ppp_ccp_reset_alloc_state function in drivers/isdn/isdn_ppp.c, which does not call init_timer for the ISDN PPP CCP reset state timer. The underlying cause is a timer initializati...

CVE-2008-2148

CVE-2008-2148 affects the Linux kernel: UTIME_NOW/UTIME_OMIT handling in sys_utimensat in 2.6.22 and older than 2.6.25.3 allows a local user to modify the timestamps of arbitrary files, potentially causing a denial of service. The root cause is improper permission checks for certain UTIME_NOW/UTI...

CVE-2013-1828

The CVE-2013-1828 issue affects the Linux kernel prior to 3.8.4, where sctp_getsockopt_assoc_stats in net/sctp/socket.c does not validate the requested size before a copy_from_user, enabling local privilege escalation via SCTP_GET_ASSOC_STATS getsockopt. Affected are kernel versions before 3.8.4;...

CVE-2013-1858

The CVE-2013-1858 issue affects the Linux kernel prior to 3.8.3, where the clone system-call mishandles a combination of CLONE_NEWUSER and CLONE_FS. This enables local users to escalate privileges by calling chroot and taking advantage of the sharing of the / directory between a parent process an...

CVE-2013-1956

The CVE-2013-1956 issue affects the Linux kernel prior to 3.8.6, where create_user_ns in kernel/user_namespace.c may bypass filesystem restrictions by not verifying that a chroot directory differs from the namespace root during a crafted clone system call. This violation could allow local users t...

CVE-2014-0102

CVE-2014-0102 affects the Linux kernel up to version 3.13.6. The vulnerability is in the function keyring_detect_cycle_iterator (security/keys/keyring.c), which does not correctly determine whether keyrings are identical. This can allow local users to cause a denial of service (OOPS) by issuing c...

CVE-2016-6776

CVE-2016-6776 is an elevation-of-privilege vulnerability in the NVIDIA Tegra kernel driver (NVHOST) where referencing memory after it has been freed may allow a local attacker to escalate to kernel code execution. The issue is documented across NVIDIA Bulletins for Jetson TK1/K1 and Tegra-line de...

CVE-2016-7912

The CVE-2016-7912 entry describes a use-after-free in the Linux kernel involving ffs_user_copy_worker in drivers/usb/gadget/function/f_fs.c, prior to version 4.5.3. This flaw lets local users escalate privileges by accessing an I/O data structure after a callback, as documented in multiple source...

CVE-2016-8412

CVE-2016-8412 is an elevation-of-privilege vulnerability in the Qualcomm camera that could allow a local malicious app to execute arbitrary code in the kernel context. The issue affects Android kernel versions 3.10 and 3.18 and is rated High because exploitation requires first compromising a priv...

CVE-2017-0329

CVE-2017-0329 is an elevation-of-privilege in the NVIDIA boot and power management processor driver on Android (Kernel 3.18). It could allow a local malicious application to execute arbitrary code within the boot/power management context after compromising a privileged process. The entry is backe...

CVE-2017-0433

CVE-2017-0433 is an elevation-of-privilege flaw in the Synaptics touchscreen driver for Android, tied to the Kernel-3.10 platform. The vulnerability could allow a local, privileged attacker to execute arbitrary code within the touchscreen chipset context. Several connected sources (including NVD ...

CVE-2017-0446

CVE-2017-0446: Elevation of privilege in the HTC touchscreen driver on Android kernel 3.18, allowing a local attacker to execute arbitrary code in kernel context. Exploitation requires compromising a privileged process and local access. Publicly available patch/fix details are not provided in the...

CVE-2017-8068

CVE-2017-8068 affects the Linux kernel 4.9.x before 4.9.11, where drivers/net/usb/pegasus.c interacts incorrectly with CONFIG_VMAP_STACK. This enables a local attacker to trigger a denial of service or memory corruption by exploiting use of more than one virtual page for a DMA scatterlist. The is...

CVE-2021-47273

CVE-2021-47273 concerns the Linux kernel component for the usb dwc3-meson-g12a PHY glue. When PHY0 is disabled and only PHY1 is used (e.g., Odroid-HC4), regmap initialization erroneously targets the usb2 path, since PHY1 regmap entry isn’t initialized. This can lead to a kernel NULL pointer deref...

CVE-2022-48888

CVE-2022-48888 (Linux kernel) affects the drm/msm/dpu path; the root cause is a memory leak in msm_mdss_parse_data_bus_icc_path. of_icc_get() allocated resources for path1 and may leak it if an early return occurs due to IS_ERR_OR_NULL(path0). The patch defers obtaining path1 to prevent the leak ...

CVE-2022-48996

CVE-2022-48996 affects the Linux kernel DAMON subsystem. The vulnerability stems from damon_sysfs_set_schemes() making assumptions that the DAMON context has no schemes, leading to incorrect creation of schemes during online tuning and a higher memory footprint. The fix, described in the commit t...

CVE-2022-49423

Summary: CVE-2022-49423 relates to the Linux kernel where RTLA tracing could dereference a NULL record in several tracing tools. Root cause (as documented): NULL pointer dereference of the variable record in multiple files (osnoise_hist.c, osnoise_top.c, timerlat_hist.c, timerlat_top.c) before ca...

CVE-2022-49806

CVEsummary (CVE-2022-49806) In the Linux kernel (net: microchip: sparx5), a potential null-pointer dereference was fixed in sparx_stats_init() and sparx5_start(). The root cause: sparx_stats_init() called create_singlethread_workqueue() without validating its return value, which can be NULL, lead...

CVE-2022-49852

Summary (CVE-2022-49852) : In the Linux kernel (riscv), thread_struct::s[12] may leak random kernel memory to userspace, exposing confidential data and impacting availability. The fix clears s[12] in thread_struct during fork, and it is advised to also clear s[12] for kthread cases. Affected: Lin...

CVE-2022-50266

The CVE-2022-50266 issue is in the Linux kernel kprobes path: kill_kprobe() incorrectly disarms a probe because KPROBE_FLAG_GONE is set before checking the probe’s enabled state, causing !kprobe_disabled(p) to evaluate to false and bypass necessary disarm handling. The fix adds the enabled-check ...

CVE-2023-53523

Technical details for CVE-2023-53523 are not publicly provided in the connected documents; no specific affected products, versions, risks, or fixes are listed beyond the initial description. Monitor for updates.

CVE-2024-57914

CVE-2024-57914 : In the Linux kernel, a NULL pointer dereference can occur in the usb: typec: tcpci code when two Type‑C ports share one IRQ. The tcpci_irq() handler may dereference a NULL regmap if an interrupt arrives for the second port before its tcpci_register_port() completes, leading to an...

CVE-2024-57989

CVE-2024-57989 : In the Linux kernel, the wifi driver for mt76 mt7925 had a NULL pointer dereference in mt7925_change_vif_links because devm_kzalloc() could return NULL and its result was not checked. The vulnerability is described as a local, low-privilege issue with high potential impact to ava...

CVE-2025-38092

CVE-2025-38092 affects the ksmbd component in the Linux kernel. Root cause: the list_first_entry() macro can yield an invalid pointer on empty lists; replaced with list_first_entry_or_null() to safely handle empty lists. Impact described in connected sources includes potential service failure and...

CVE-2025-38133

CVE-2025-38133 affects the Linux kernel’s IIO ADC driver (ad4851/ad4858). The root cause was pointer arithmetic: ad4851_parse_channels_common() advances the channel pointer, and ad4858_parse_channels() advanced it again when setting ext_scan_type, causing indio_dev->channels to point past the ...

CVE-2025-38233

The CVE 2025-38233 entry describes a Linux kernel PPC64 ftrace livepatching issue where r15 is clobbered and not restored in the livepatch sequence, causing kernel faults (example trace shows an oops and bad memory access). Connected docs confirm concrete fixes: restore r15 unconditionally in the...

CVE-2025-38254

The CVE-2025-38254 issue is in the Linux kernel (drm/amd/display) where drm_edid_raw() could return NULL or oversized EDID bytes, risking an Oops or memory corruption. The fix adds sanity checks for drm_edid_raw() and returns EDID_BAD_INPUT in those corner cases. It is related to EDID handling wh...

CVE-2025-38339

CVE-2025-38339: Linux kernel powerpc/bpf trampoline JIT size calculation could overflow when arch_bpf_trampoline_size() estimates size before allocation. The dummy pass size may differ from actual JIT needs, causing a WARN_ON_ONCE overflow check in arch/powerpc/net/bpf_jit_comp.c. The fix account...

CVE-2025-38341

CVE-2025-38341 pertains to the Linux kernel fbnic driver. The issue is described as a double-free scenario when DMA-mapping a FW message fails within fbnic_mbx_map_msg(), with the documented behavior that the caller retains ownership of the message on error and the page is freed by existing calle...

CVE-2025-38407

CVE-2025-38407 (Linux kernel, RISC‑V) is addressed by replacing the dynamic percpu boot data area with a statically allocated array in the kernel image to fix boot on NUMA SMP configurations. The root cause was that, when percpu page allocation happens early with NUMA, percpu data could be placed...

CVE-2025-38423

CVE-2025-38423 — Linux kernel, ASoC: codecs: wcd9375. The issue occurs in the probe path where regulator supplies are obtained with devm_regulator_bulk_get() and could be freed twice if regulator_bulk_free() is called in error paths, leading to a potential double-free situation. The published fix...

CVE-2025-38554

CVE-2025-38554 in the Linux kernel describes a use-after-free (UAF) involving VMAs: if vma->mm is freed after vma->vm_refcnt has dropped, a recycled VMA could be mishandled, leading to UAF. The race can occur when VMAs are recycled under RCU (with SLAB_TYPESAFE_BY_RCU) and lock_vma_under_rc...

CVE-2025-38652

CVE-2025-38652: In the Linux kernel, a f2fs path handling bug can cause out-of-bounds access when constructing devs.path for a device, due to sbi->devs.path[] not leaving space for the trailing null terminator. Root cause: device path storage (path[MAX_PATH_LEN]) can be fully filled, causing p...

CVE-2025-38725

CVE-2025-38725 affects the Linux kernel net: usb: asix_devices driver handling of ax88772 MDIO bus. Without a phy_mask, the driver could create up to 32 MDIO phy devices (addresses 0x00–0x1f). Only one main phy binds to the net phy driver, causing issues during suspend/resume where phy_polling_mo...

CVE-2025-39843

CVE-2025-39843 affects the Linux kernel mm/slub path. The vulnerability arises when set_track_prepare() can incur lock recursion due to waking up kswapd while holding per_cpu(hrtimer_bases)[n].lock (triggered via hrtimer_start_range_ns) under CONFIG_DEBUG_OBJECTS_TIMERS. The fix involves masking ...

CVE-2025-39899

CVE-2025-39899 concerns the Linux kernel mm/userfaultfd path where, on 32-bit ARM with CONFIG_HIGHPTE, move_pages_pte() maps PTE pages using kmap_local_page() and must unmap them in LIFO order. The current code unmapped dst_pte then src_pte in the same sequence, violating LIFO and triggering a ku...

CVE-2025-39957

CVE-2025-39957 affects the Linux kernel wireless stack (wifi: mac80211) where S1G capability length was not accounted for in scan_ies_len, causing a buffer length validation failure in ieee80211_prep_hw_scan() and a WARN in __ieee80211_start_scan(). The fix adds S1G length to the calculation to e...

CVE-2026-23173

CVE-2026-23173 affects the Linux kernel mlx5e driver (TC flow offload). The issue arises when deleting TC steering flows: the code previously iterated over all possible ports, potentially touching non-existent peers and risking a NULL pointer dereference. The fix ensures cleanup only occurs for d...

CVE-2026-23269

CVE-2026-23269 is an AppArmor/Linux kernel vulnerability where untrusted data is used as DFA start-state indices during unpack_pdb, enabling an out-of-bounds read in aa_dfa_next (via dfa->tables[YYTD_ID_BASE][start]). The issue is tied to the AppArmor LSM component and the root cause is readin...

CVE-2026-31674

The CVE-2026-31674 issue affects the Linux kernel netfilter ip6t_rt module, where processing IPv6 routing header (RT) match rules can overflow addrnr if it exceeds IP6T_RT_HOPS. The root cause is rt_mt6() using addrnr outside rtinfo->addrs[] bounds. A patch added validation of addrnr during ru...

CVE-2026-43186

The CVE-2026-43186 issue affects the Linux kernel IOAM code path for IPv6 (IOAM6). A crafted packet could cause a heap-buffer overflow in __ioam6_fill_trace_data() on the receive path by setting nodelen inconsistently with trace->type, leading to writes beyond the allocated region and possible...

CVE-2026-45859

The CVE-2026-45859 entry describes a Linux kernel netfilter nfnetlink_queue issue where a shared-unconfirmed nf_conn entry is not checked before segmentation, causing UDP packets to be dropped instead of queued when F_GSO is not set and a GSO packet arrives. The regression arose due to the check ...

CVE-2026-46120

Concrete details found: CVE-2026-46120 affects the Linux kernel ip6_gre machinery. The issue is in ip6erspan_changelink(), which wrongly uses dev_net(dev) instead of the correct per-netns hash resolved by link_net, after a patch series that fixed per-netns resolution in ip6erspan_newlink(). This ...

CVE-2026-46299

CVE-2026-46299 (Linux kernel) affects the hfsplus filesystem during mount. hfsplus_fill_super() calls hfs_find_init() to initialize a search structure, which grabs tree->tree_lock. If hfsplus_cat_build_key() fails, control jumps to out_put_root without releasing the lock, causing a later clean...

CVE-2026-46303

The CVE-2026-46303 vulnerability affects the Linux kernel isofs Rock Ridge CE handling. rock_continue() could use rs->cont_extent without validating the block number, allowing potential reads of data from an adjacent filesystem via sb_bread() on crafted ISO mounts. The issue was addressed by p...

CVE-2026-53145

Summary of CVE-2026-53145 (Linux kernel drm/gem change_handle race) : A race between gem_close and gem_change_handle ioctls in the DRM GEM subsystem was addressed but not cleanly fixed initially. The root cause involved confusion around the local handle variable (which is the new handle) and seve...

CVE-2026-53268

CVE-2026-53268 affects the Linux kernel netfilter component, specifically the conntrack_irc module. The root cause is a failure to bail out after a command string is matched, which can lead to an out-of-bounds read during parsing. Impact per sources is a potential information disclosure or denial...

CVE-2026-53328

CVE-2026-53328 relates to the Linux kernel sched_ext path, where a WARN was triggered during cgroup migration when scx_cgroup_move_task() encountered a NULL cgrp_moving_from. The root cause was a mismatch between cgroup identity used for migration (css) and identity used for migration triggering,...

CVE-2026-53375

CVE-2026-53375 affects the Linux kernel, specifically the drm/amdgpu/vce component. The issue arises during patching when only one of the lo/hi address parts is valid, which could cause a bad address to be written to firmware. The vulnerability is described as resolved, with linked kernel commits...

CVE-2026-63797

The CVE-2026-63797 fix addresses a use-after-free in the Linux kernel rpmsg character device path. If rpmsg_chrdev_eptdev_add() fails after rpmsg_chrdev_probe() stores the new eptdev in the default endpoint’s priv pointer, the eptdev may be freed while callbacks still access the stale priv. The p...