CVE-2026-31684

The CVE-2026-31684 issue is in the Linux kernel’s net/sched pathology (act_csum) where tcf_csum_act() reads nested VLAN headers directly from skb->data if the payload contains VLAN tags, and may read VLAN_HLEN bytes before guaranteeing the full header is present. The root cause is that the cod...

CVE-2025-39698

CVE-2025-39698 concerns the Linux kernel io_uring/futex cleanup: io_futex_data is allocated upfront and wired into io_kiocb.async_data, but the request flag REQ_F_ASYNC_DATA may not be set at that time. On failure, the futex handler frees the data but may not clear async_data, so the data and fla...

CVE-2025-39843

CVE-2025-39843 affects the Linux kernel mm/slub path. The vulnerability arises when set_track_prepare() can incur lock recursion due to waking up kswapd while holding per_cpu(hrtimer_bases)[n].lock (triggered via hrtimer_start_range_ns) under CONFIG_DEBUG_OBJECTS_TIMERS. The fix involves masking ...

CVE-2025-39899

CVE-2025-39899 concerns the Linux kernel mm/userfaultfd path where, on 32-bit ARM with CONFIG_HIGHPTE, move_pages_pte() maps PTE pages using kmap_local_page() and must unmap them in LIFO order. The current code unmapped dst_pte then src_pte in the same sequence, violating LIFO and triggering a ku...

CVE-2025-39955

The CVE-2025-39955 entry concerns the Linux kernel TCP Fast Open path. The root cause is that tcp_disconnect() failed to clear tcp_sk(sk)->fastopen_rsk, allowing the retransmit timer to trigger while a TFO socket is being reused, potentially delaying or missing a retransmission. The fix implem...

CVE-2025-39964

In CVE-2025-39964, the Linux kernel’s crypto/af_alg implementation now disallows concurrent writes to the same af_alg socket. The root cause is a race in af_alg_sendmsg where two writes could interleave or corrupt internal state; a new ctx->write field enforces exclusive ownership for writing....

CVE-2025-71074

CVE-2025-71074 concerns the Linux kernel’s functionfs subsystem, where a race between open and removal can leave a freed object referenced by file->private_data. The root cause is the way ffs->opened is updated; using atomic_dec_and_test() vs atomic_add_return() leads to a window where an o...

CVE-2025-71112

The CVE-2025-71112 entry concerns the Linux kernel net/hns3 VLAN handling. A VLAN ID may be used without validation when receiving a VLAN configuration mailbox from a VF, because vlan_del_fail_bmap length (BITS_TO_LONGS(VLAN_N_VID)) can permit out-of-bounds access if the VLAN ID is >= VLAN_N_V...

CVE-2025-71160

CVE-2025-71160 relates to the Linux kernel netfilter nf_tables chain validation. The vulnerability arises from the validator traversing the entire chain graph (base chains and chain jumps), which can trigger CPU soft lockups in nft_chain_validate under certain input paths. The change described ai...

CVE-2026-23109

CVE-2026-23109 affects the Linux kernel writeback subsystem. The vulnerability arises in fs/writeback: skip AS_NO_DATA_INTEGRITY mappings in wait_sb_inodes(), where the system must wait for all pages under writeback for data integrity. Because some mappings (e.g., FUSE) do not enforce data integr...

CVE-2026-23269

CVE-2026-23269 is an AppArmor/Linux kernel vulnerability where untrusted data is used as DFA start-state indices during unpack_pdb, enabling an out-of-bounds read in aa_dfa_next (via dfa->tables[YYTD_ID_BASE][start]). The issue is tied to the AppArmor LSM component and the root cause is readin...

CVE-2026-43209

CVE-2026-43209 – minix filesystem sanity check in Linux kernel : The minix filesystem implementation lacked proper sanity checks in minix_check_superblock(), notably for s_log_zone_size, which the patch now enforces (only 0 is supported). The update also adds sanity checks for other superblock fi...

CVE-2026-43229

The CVE-2026-43229 issue affects the Linux kernel via the chips-media wave5 driver. The root cause is an incorrect device cleanup order: video device unregistration was performed after power/runtime disable and hardware power-down, allowing a kthread worker to read hardware registers after autosu...

CVE-2026-45931

The CVE-2026-45931 issue affects the Linux kernel’s accel/amdxdna module. A crash can occur in iommu_sva_unbind_device() when it accesses iommu_mm after the associated mm structure has been freed. The fix is to take an explicit reference to the mm structure after successfully binding the device a...

CVE-2026-46098

CVE-2026-46098 affects the Linux kernel caif driver. The vulnerability arises when, after remote shutdown, caif_connect() tears down a client by calling caif_disconnect_client() and caif_free_client(), where caif_free_client() releases the service layer pointer but leaves adap_layer->dn dangli...

CVE-2026-46265

The CVE-2026-46265 issue affects the Linux kernel RDMA/hns path. When sunrpc is in use and a reset occurs, QP destruction may lead to a WQ_MEM_RECLAIM dependency warning during workqueue flushing, risking kernel instability. The fixed code fixes the WQ_MEM_RECLAIM handling in the RDMA/hns path (Q...

CVE-2026-46273

The CVE-2026-46273 entry describes a Linux kernel vulnerability in the ibmveth driver affecting Power systems: GSO offload fails when MSS < 224 bytes, potentially freezing the network adapter and causing DoS until a manual reset. The fix adds an ndo_features_check to disable GSO for MSS 1; si...

CVE-2026-46303

The CVE-2026-46303 vulnerability affects the Linux kernel isofs Rock Ridge CE handling. rock_continue() could use rs->cont_extent without validating the block number, allowing potential reads of data from an adjacent filesystem via sb_bread() on crafted ISO mounts. The issue was addressed by p...

CVE-2026-46307

CVE-2026-46307 affects the Linux kernel ath5k driver, where a UBSAN-detected array-index-out-of-bounds in ath5k_tasklet_tx can write beyond a 4-entry ieee80211_tx_rate array, potentially overwriting the next info->status field (ack_signal). Rootcause: ts_final_idx may be 3, causing an out-of-b...

CVE-2026-52982

The CVE-2026-52982 issue affects the Linux kernel driver rtl8150 for Realtek RTL8150 USB Ethernet devices. A use-after-free (UAF) can occur in rtl8150_start_xmit() when reading skb->len for tx_bytes statistics after usb_submit_urb() is issued, because the skb may be freed in the USB completion...

CVE-2026-53335

The CVE-2026-53335 issue concerns the Linux kernel DAMON_LRU_SORT path (mm/damon/lru_sort). The root cause is damon_ctx allocation failure in the init path, which may lead to a NULL ctx passed to damon_commit_ctx() and a NULL pointer dereference. The documented fix is to return -ENOMEM if ctx is ...

CVE-2026-53356

CVE-2026-53356 concerns the Linux kernel’s DRM i915 GEM phys BO handling. The issue stems from sg_page() returning a struct page pointer instead of a void*, which makes pread/pwrite offset scaling incorrect and risks accessing inappropriate parts of the BO when a non-zero offset is used. The vuln...

CVE-1999-0257

CVE-1999-0257 corresponds to the Nestea variation of the teardrop IP fragmentation denial-of-service attack. The connected documents consistently describe a network DoS via IP fragmentation handling, without citing concrete affected products, versions, or a confirmed remediation patch within the ...

CVE-2001-1397

CVE-2001-1397 affects the System V shared memory implementation in the Linux kernel before version 2.2.19. The issue allows attackers to modify recently freed memory within SYSV shared memory. Public sources consistently describe this as a kernel memory handling flaw rather than a user-space vuln...

CVE-2002-1571

CVE-2002-1571 affects the Linux 2.4 kernel pre-2.4.19. The root cause is that the fninit instruction is assumed to clear all registers, which can cause an information leak on processors that do not clear all relevant SSE registers. The practical impact is potential leakage of information (partial...

CVE-2004-0228

CVE-2004-0228 refers to an integer signedness error in the cpufreq /proc handler (cpufreq_procctl) of the Linux 2.6 kernel, enabling local users to escalate privileges to kernel level. The issue is discussed in multiple advisories (e.g., SUSE, Gentoo GLSA 200407-02, Fedora 2004-111) as part of Li...

CVE-2004-0229

CVE-2004-0229 affects the Linux kernel 2.6.x framebuffer driver, where the fb_copy_cmap function is not used correctly to copy cmap structures. The impact is listed as unknown in the primary CVE records, with local access required (attack vector: LOCAL, low complexity, no authentication). Connect...

CVE-2004-2536

Summary of CVE-2004-2536 : The Linux kernel 2.6.x releases up to 2.6.5 contain a fault in the exit_thread path (process.c) where per-TSS io_bitmap pointers are not invalidated when a process obtains IO permissions via ioperm and later exits. This can allow other processes to access the per-TSS po...

CVE-2005-0207

CVE-2005-0207 corresponds to an unknown vulnerability in Linux kernel 2.4.x, 2.5.x, and 2.6.x where NFS clients can trigger a denial of service via NFS client O_DIRECT error handling. The issue is documented in multiple advisories (RHSA-2005:366 / CESA-2005:366) and CentOS/Ubuntu/NVD entries. Aff...

CVE-2005-1764

CVE-2005-1764 is a kernel vulnerability affecting Linux 2.6 on 64-bit x86 (x86_64). The issue arises because the 47‑bit address page guard is not used, leaving the system vulnerable to local DoS via AMD K8 bug exploitation. Documents confirm the flaw and note that updates/patches were released (e...

CVE-2005-3119

CVE-2005-3119 affects the Linux kernel 2.6.10 through 2.6.13, where a memory leak in request_key_auth_destroy (within request_key_auth) can be exploited by a local user to cause denial of service via excessive authorization token keys. The connected advisories indicate this vulnerability is addre...

CVE-2005-3753

CVE-2005-3753 affects the Linux kernel in the 2.6.x line, around versions near 2.6.12 up to 2.6.13.1. The issue could allow a denial of service (an Oops) via certain IPSec packets that trigger alignment problems in standard multi-block cipher processors. The description notes it is not clear whet...

CVE-2005-3808

The CVE-2005-3808 issue affects the Linux kernel (versions 2.6.11–2.6.14). A 32‑bit system executing 64‑bit mmap calls can trigger an integer overflow in invalidate_inode_pages2_range, allowing local users to cause a denial of service (hang). Multiple advisories confirm the vulnerability across d...

CVE-2005-4351

CVE-2005-4351 – Summary (concrete details from connected docs): The vulnerability affects BSD Securelevels implementations in FreeBSD (up to 6.0-STABLE and 7.0-CURRENT), OpenBSD (up to 3.8), DragonFly (up to 1.2), and Linux (up to 2.6.15). The root cause is that, while securelevels protect files ...

CVE-2006-0555

Vulnerability: CVE-2006-0555 affects the Linux kernel prior to 2.6.15.5, where NFS client operations using O_DIRECT can cause the kernel to panic and crash (local denial of service). Affected product is the Linux kernel; root cause relates to direct I/O handling for NFS. Public advisories from Re...

CVE-2006-3085

CVE-2006-3085 affects the Linux kernel’s SCTP handling in xt_sctp within netfilter, where an SCTP chunk of length 0 can trigger a DoS either by an infinite loop (or crash in some reports). The vulnerability is listed as applicable to kernels before 2.6.17.1. Public references from multiple source...

CVE-2010-1488

The CVE-2010-1488 issue affects the Linux kernel prior to 2.6.34-rc4, where proc_oom_score in fs/proc/base.c selects a candidate for the OOM killer using inappropriate data structures. This could allow local users to trigger a denial of service via certain task-creation patterns. The vulnerabilit...

CVE-2010-5328

The CVE affects the Linux kernel, specifically signals targeting a process group ID of zero reaching the swapper due to a flaw in include/linux/init_task.h prior to 2.6.35. This allows a local user to trigger a denial of service (system crash). The vulnerability is caused by insufficient filterin...

CVE-2016-8460

CVE-2016-8460 : An information disclosure in the NVIDIA Tegra kernel driver (NVMAP) could leak uninitialized stack memory to a local user, enabling data exposure. Affected: Android on Kernel-3.10 (Nexus 9 cited). Impact per sources: information disclosure; CVSS v3 base 5.5 (medium). Remediation: ...

CVE-2016-8475

CVE-2016-8475 describes an information-disclosure vulnerability in the HTC input driver on Android platforms running kernel 3.18. A local malicious application could access data outside its normal permission set after compromising a privileged process. The issue is documented as affecting Android...

CVE-2017-0330

CVE-2017-0330 affects NVIDIA’s Tegra kernel via the NVIDIA crypto driver. The connected NVIDIA security bulletin details that the vulnerability arises from a user-supplied pointer not being correctly validated in the crypto driver, potentially enabling denial of service or privilege escalation. A...

CVE-2017-0331

CVE-2017-0331 (NVIDIA Tegra kernel driver, NVMAP): An elevation-of-privilege/DoS issue where untrusted data can change between validation and use, potentially allowing a local attacker to escalate privileges or cause kernel-state impact. Affected context references Android on kernel 3.10 and the ...

CVE-2017-0435

CVE-2017-0435 is an elevation-of-privilege in the Qualcomm sound driver affecting Android kernels (Kernel-3.10 and Kernel-3.18). The vulnerability could let a local malicious app execute arbitrary code in the kernel context after compromising a privileged process. The CVE is documented with Qualc...

CVE-2017-0437

CVE-2017-0437 is an elevation-of-privilege vulnerability in the Qualcomm Wi‑Fi driver on Android. The issue could allow a local malicious app to execute arbitrary code in the kernel context by exploiting the Qualcomm Wi‑Fi driver, with the Android kernel versions cited as Kernel-3.10 and Kernel-3...

CVE-2017-0519

CVE-2017-0519 describes an elevation-of-privilege vulnerability in the Qualcomm fingerprint sensor driver for Android (kernel 3.18). A local attacker could exploit this to execute arbitrary code in the kernel context by compromising a privileged process. The entry remains focused on Android and k...

CVE-2017-0573

CVE-2017-0573 describes an elevation of privilege in the Broadcom Wi‑Fi driver used by Android, enabling a local malicious application to execute arbitrary code in the kernel. Affected: Android on Kernel-3.10 and Kernel-3.18. Root cause: elevation of privilege via Broadcom Wi‑Fi driver; no specif...

CVE-2017-0577

CVE-2017-0577 is an elevation-of-privilege vulnerability in the HTC touchscreen driver for Android kernels (kernel 3.18) that could let a local malicious app execute code in the kernel context. The issue is triggered by compromising a privileged process and does not require network access or user...

CVE-2022-48819

Summary: CVE-2022-48819 affects the Linux kernel TCP path. When mixing sendpage() data and MSG_ZEROCOPY via the same socket, a warning in inet_sock_destruct() (sk_forward_alloc_get(sk)) could be triggered, due to the sendpage() path being forgotten in zerocopy handling and the need to keep zeroco...

CVE-2022-50509

CVE-2022-50509 is a Linux kernel vulnerability in media: coda where kmalloc return value is not checked, risking NULL pointer dereference. The issue was fixed by adding a return-value check to kmalloc usage to prevent dereferencing a NULL pointer. Affected component: Linux kernel (media: coda) wi...

CVE-2023-20674

The CVE-2023-20674 issue affects the WLAN component in MediaTek devices, caused by an out-of-bounds read due to a missing bounds check. This vulnerability could allow local information disclosure and may enable system-level execution privileges, with no user interaction required. Multiple feeds (...