CVE-2025-38339

CVE-2025-38339: Linux kernel powerpc/bpf trampoline JIT size calculation could overflow when arch_bpf_trampoline_size() estimates size before allocation. The dummy pass size may differ from actual JIT needs, causing a WARN_ON_ONCE overflow check in arch/powerpc/net/bpf_jit_comp.c. The fix account...

CVE-2025-38513

CVE-2025-38513 : Linux kernel WiFi zd1211rw driver fix for a potential NULL pointer dereference in zd_mac_tx_to_dev(). The patch adds a NULL check before calling zd_mac_tx_status() to handle the race where skb = __skb_dequeue(q) can return NULL after the distance between queue-length checks and d...

CVE-2025-38543

CVE-2025-38543 is a Linux kernel vulnerability affecting the drm/tegra nvdec path. The root cause is a missing NULL check after dma_alloc_coherent, resolved by aligning with Robin's fix for vic.c (DMA API misuse). The impact, per the entry, is a HIGH availability impact with no confidentiality or...

CVE-2025-38584

The CVE-2025-38584 issue is a Linux kernel vulnerability in the padata subsystem. A race condition/use-after-free could occur in padata_reorder after a padata item is enqueued but before the next item is prepared, potentially allowing premature dereference of the pd reference. The fix updates the...

CVE-2025-38588

CVE-2025-38588 affects the Linux kernel IPv6 path: an infinite loop in rt6_nlmsg_size() due to list_del_rcu() interactions with rt6_nh structures, potentially causing denial of service. The patch reworks the loop by restarting when f6i->fib6_nsiblings is zero, and kernel live patches/advisorie...

CVE-2025-38670

CVE-2025-38670 affects ARM64 Linux kernel. The vulnerability arises in cpu_switch_to() and call_on_irq_stack() where masking and saving the DAIF state and SCS pointers are not atomic across stack switches, allowing a race during task/IRQ stack transitions. Interrupts (SErrors/Debug Exceptions) ca...

CVE-2025-39840

The CVE-2025-39840 in the Linux kernel is a fixed out-of-bounds read in audit_compare_dname_path() when a watch on / coincides with a single-character create under / (e.g., /a). The root cause is that parent_len() returns 1 for "/"; audit_compare_dname_path() can set pathlen to 0 and dereference ...

CVE-2025-39955

The CVE-2025-39955 entry concerns the Linux kernel TCP Fast Open path. The root cause is that tcp_disconnect() failed to clear tcp_sk(sk)->fastopen_rsk, allowing the retransmit timer to trigger while a TFO socket is being reused, potentially delaying or missing a retransmission. The fix implem...

CVE-2026-23207

CVE-2026-23207 concerns the Linux kernel SPI Tegra210 quad driver. The issue arose because curr_xfer accesses were not consistently protected by the lock in the IRQ thread path, enabling a race against the timeout path where curr_xfer could be NULL after being cleared but still dereferenced in ha...

CVE-2026-31488

The CVE-2026-31488 entry concerns a Linux kernel issue in the DRM/AMD display path where DSC (display stream compression) validation could drop the mode_changed flag for an unrelated mode change within the same KMS commit. This could cause new streams to be created for DSC-independent CRTCs, whil...

CVE-2026-31682

CVE-2026-31682 affects the Linux kernel bridge implementation, where br_nd_send may parse non-linear ND options from ns->opt[]. The root cause is failure to linearize the skb before ND option parsing, risking reads past the buffer and potential memory exposure or crash. The fix is to linearize...

CVE-2026-46226

CVE-2026-46226 affects the Linux kernel SPI FSL driver, where deregistration of the controller was not ensured before releasing DMA resources during driver unbind. The issue is fixed in updated kernels across multiple OS packages (e.g., Root:Debian-11/12, Ubuntu 22.04+, Debian/Ubuntu roots with r...

CVE-2026-46265

The CVE-2026-46265 issue affects the Linux kernel RDMA/hns path. When sunrpc is in use and a reset occurs, QP destruction may lead to a WQ_MEM_RECLAIM dependency warning during workqueue flushing, risking kernel instability. The fixed code fixes the WQ_MEM_RECLAIM handling in the RDMA/hns path (Q...

CVE-2026-53131

In CVE-2026-53131, multiple netfilter-related paths in the Linux kernel (including ip6t_eui64, xt_mac, and several ipset types) could access Ethernet MAC header data via eth_hdr(skb) without first verifying that the skb is associated with an Ethernet device or that the MAC header is present and l...

CVE-1999-1285

CVE-1999-1285 affects Linux kernels 2.1.132 and earlier. A local attacker can cause a denial of service by reading a large buffer from a random device (e.g., /dev/urandom) that cannot be interrupted until the read completes. The provided documents specify the vulnerability and impact (resource ex...

CVE-2004-2135

Cryptoloop in Linux kernel 2.6.x, when used on file systems with a block size of 1024 or greater, contains IV computation weaknesses that allow watermarked files to be detected without decryption. The documented impact is PARTIAL confidentiality loss. No exploits, specific remediations, or affect...

CVE-2004-2136

The CVE-2004-2136 entry concerns dm-crypt in the Linux kernel (2.6.x) used on certain filesystems with block sizes of 1024 or greater. The underlying issue is an IV computation weakness in the encryption mode that can allow watermarked files to be detected without decrypting the data. The availab...

CVE-2005-0977

The CVE-2005-0977 entry concerns the Linux kernel 2.6 tmpfs shmem_nopage function, where the address argument is not properly verified in shmem.c. This allows a local user to trigger a denial of service (kernel crash) via an invalid address. Public advisories (RHSA-2005:366 / CESA-2005:366) indic...

CVE-2016-10283

CVE-2016-10283 is an elevation-of-privilege flaw in the Qualcomm Wi‑Fi driver for Android that allows a local malicious app to execute arbitrary code in the kernel context after compromising a privileged process. The issue affects Kernel-3.10/3.18 Android builds (Android 5.x–7.x era devices inclu...

CVE-2016-10291

CVE-2016-10291 involves an elevation of privilege in the Qualcomm Slimbus driver affecting Android kernels (Kernel-3.10). The issue allows a local malicious app to execute arbitrary code in the kernel context via this driver. Public exploitation details are not provided in the supplied documents....

CVE-2016-8431

CVE-2016-8431 describes a local elevation of privilege in the NVIDIA GPU driver on Android (Android Kernel 3.18; Pixel C). The vulnerability can allow a local malicious process to execute arbitrary code in kernel context, with potential for permanent device compromise. Connected documents indicat...

CVE-2016-8434

CVE-2016-8434 is a local elevation-of-privilege vulnerability in the Qualcomm GPU driver that could allow a malicious local app to execute arbitrary code in the kernel context on Android with Kernel-3.10. The impact is a potential local root compromise. The vulnerability is documented in NVD with...

CVE-2016-8455

CVE-2016-8455 describes an elevation of privilege in the Broadcom Wi‑Fi driver affecting Android devices using kernel 3.10 (notably Nexus 6P). A local malicious application could execute arbitrary code in the kernel after compromising a privileged process. The connected documents confirm the issu...

CVE-2016-8474

CVE-2016-8474 is an information disclosure vulnerability in the STMicroelectronics driver on Android (kernel 3.10). A local malicious app could access data beyond its permissions, requiring compromise of a privileged process. CVSS3: 4.7 (MEDIUM), local, user interaction required; confidentiality ...

CVE-2017-0520

CVE-2017-0520 is an elevation-of-privilege vulnerability in the Qualcomm crypto engine driver that could allow a local malicious Android app to execute code in the kernel context. Affected components: Qualcomm crypto engine driver; vulnerable against Android kernels 3.10 and 3.18. Trigger require...

CVE-2017-0612

CVE-2017-0612 describes an elevation of privilege in the Qualcomm Secure Execution Environment Communicator driver on Android kernel 3.18. A local malicious application could exploit this to execute arbitrary code in the kernel context after compromising a privileged process. The vulnerability is...

CVE-2017-0619

The CVE-2017-0619 entry describes an elevation-of-privilege vulnerability in the Qualcomm pin controller driver on Android kernels (Kernel-3.10). A local malicious app could execute arbitrary code in the kernel context. The CVSS indicates LOCAL access with HIGH impact on confidentiality, integrit...

CVE-2022-49785

The CVE-2022-49785 entry concerns the Linux kernel SGX subsystem. The issue arises in sgx_validate_offset_length(), which verifies userspace-provided offset and length but lacked an overflow check on their addition. The documented fix adds an overflow check to prevent arithmetic overflow when com...

CVE-2022-49994

The CVE-2022-49994 issue affects the Linux kernel memory management path involving bootmem and kmemleak. Specifically, vmemmap pages allocated from memblock were not removed from kmemleak when the page was freed, allowing kmemleak to report an error or stop working when the page is reused. The co...

CVE-2024-43874

CVE-2024-43874 affects the Linux kernel crypto CCP/SEV path. The vulnerability is a NULL pointer dereference in __sev_snp_shutdown_locked triggered when psp_device or sev_device are uninitialized due to DEBUG_TEST_DRIVER_REMOVE. The fix returns early from __sev_snp_shutdown_locked() if these stru...

CVE-2025-38070

The CVE-2025-38070 entry concerns the Linux kernel ASoC sma1307 driver. The vulnerability arises from missing NULL checks in sma1307_setting_loaded(), with allocations via kzalloc and devm_kzalloc that could be NULL. The connected Astra Linux advisory confirms this description and notes that mult...

CVE-2025-38164

CVE-2025-38164 affects the Linux kernel’s F2FS implementation. A patch fixes an inconsistency bug where a GC/pinning sequence could leave SIT and SSA in conflicting states, triggered by operations like fallocate and pinfile set. The fix adds a condition in f2fs_gc_range() to skip block migration ...

CVE-2025-38253

CVE-2025-38253: In the Linux kernel HID driver for Wacom, wacom_aes_battery_handler() could crash if the device was removed while a pending aes_battery_work was scheduled. The fix cancels aes_battery_work in wacom_remove() to prevent a crash, addressing a use-after-free/pending-work scenario on d...

CVE-2025-38297

CVE-2025-38297: In the Linux kernel, a division-by-zero could occur in em_compute_costs() for non-CPU devices due to uninitialized table[i].performance. The fix adds a _is_cpu_device(dev) check to em_init_performance() paths to prevent the division. Public advisories (e.g., openSUSE SUSE-SU-2026:...

CVE-2025-38421

CVE-2025-38421 affects the Linux kernel’s amd-pmf code in platform/x86/amd, where a path that fails smart PC setup could lead to a double free of dev->buf during module removal. The root cause is a freed pointer that isn’t NULL’d, causing amd_pmf_remove() to free it again. The provided fixes c...

CVE-2025-38423

CVE-2025-38423 — Linux kernel, ASoC: codecs: wcd9375. The issue occurs in the probe path where regulator supplies are obtained with devm_regulator_bulk_get() and could be freed twice if regulator_bulk_free() is called in error paths, leading to a potential double-free situation. The published fix...

CVE-2025-38446

CVE-2025-38446 affects the Linux kernel clock Framework for imx (ARM i.MX95 DT). The issue is an out-of-bounds access in dispmix_csr_clk_dev_data inside __clk_register() when num_parents is 4, accessing parent_names beyond the valid range. The bug manifests as a KASAN global-out-of-bounds read (s...

CVE-2025-38452

CVE-2025-38452 affects the Linux kernel’s net/ethernet RTSN driver. The vulnerability was in a null pointer dereference in rtsn_probe(), addressed by adding a check for the return value of rcar_gen4_ptp_alloc(). This mitigates potential null pointer dereference and reduces the risk of a local imp...

CVE-2025-38469

Technical details for CVE-2025-38469 are not publicly provided in the supplied documents; monitor for updates.

CVE-2025-38548

CVE-2025-38548 affects the Linux kernel hwmon driver for Corsair Corsair-CPro. The root cause is improper validation of the input buffer size received by the USB command path, allowing potential mismatches between the reported and actual buffer lengths. The fix, as documented in the connected Ast...

CVE-2025-38552

The CVE-2025-38552 entry concerns a race in Multipath TCP (mptcp) within the Linux kernel, where subflow creation could race with subflow failure. The reported fix uses a separate flag, protected by the socket fallback lock, to track the condition that prevents any additional subflow creation, wi...

CVE-2025-38582

CVE-2025-38582 affects the Linux kernel RDMA/hns (hns_roce) stack. The root cause is a double destruction of rsv_qp: free_mr_init() can run twice (once in free_mr_init() during error flow and again in hns_roce_exit()), leading to LIST_POISON1 corruption in the qP destroy path. The fix moves the f...

CVE-2025-38585

CVE-2025-38585 concerns Linux kernel staging/atomisp: a stack buffer overflow in gmin_get_var_int() triggered when gmin_get_config_var() calls EFI get_variable() with a larger-than-expected EFI variable. The bug stems from two issues: (1) gmin_get_config_var() returning a stale error code on EFI ...

CVE-2025-38610

CVE-2025-38610 affects the Linux kernel powercap codebase, specifically the dtpm_cpu path. The vulnerability is caused by a NULL dereference in get_pd_power_uw() when em_cpu_get() returns NULL, which can occur if a CPU becomes unavailable at runtime and get_cpu_device() yields NULL, propagating t...

CVE-2025-38665

CVE-2025-38665 (Linux kernel CAN): A NULL pointer dereference in netlink can_changelink() when restarting a CAN device, due to missing can_priv::do_set_mode callback. Two code paths call this callback: manual restart via can_changelink() and delayed automatic restart after bus off. The fix preven...

CVE-2025-38724

CVE-2025-38724 affects the Linux kernel; nfsd4_setclientid_confirm() could race with an expiring confirmed client due to not checking get_client_locked() return value, risking a use-after-free. The fix applies to scenarios with an extant confirmed client by obtaining a reference earlier and handl...

CVE-2025-39713

The CVE-2025-39713 entry concerns the Linux kernel media: rainshadow-cec driver, where rain_interrupt() performed a buffer-full check on rain->buf_len before acquiring rain->buf_lock. This TOCTOU race could allow concurrent interrupts to overflow the buffer (DATA_SIZE) by writing beyond cap...

CVE-2025-39744

The CVE-2025-39744 issue affects the Linux kernel and describes a deadlock in rcu_read_unlock() when called during irq_exit() if an IPI is issued. The root cause is an incorrect handling of irq_work state inside rcu_read_unlock_special() triggered by irq_exit(), which can cause a system hang/lock...

CVE-2025-39823

CVE-2025-39823 is a Linux kernel KVM/CPU virtualization vulnerability affecting x86 where indices from the guest (min, dest_id) were used with array_index_nospec after bounds checks. The issue enables speculative execution side-channel leakage affecting confidentiality, integrity, and availabilit...

CVE-2026-23213

CVE-2026-23213 affects the Linux kernel’s DRM/AMD/PM path. During an SMU Mode 1 reset, the ASIC goes through a reset cycle and becomes temporarily inaccessible via PCIe, risking uncompleted PCIe transactions that can trigger NMI panics or system hangs. The fix disables MMIO access during the offl...