CVE-2026-63797

The CVE-2026-63797 fix addresses a use-after-free in the Linux kernel rpmsg character device path. If rpmsg_chrdev_eptdev_add() fails after rpmsg_chrdev_probe() stores the new eptdev in the default endpoint’s priv pointer, the eptdev may be freed while callbacks still access the stale priv. The p...

CVE-2026-46166

The CVE-2026-46166 affects the Linux kernel’s wireless subsystem (mac80211) in the radar detect work. The root cause is unsafe list iteration during radar processing, where ieee80211_dfs_cac_cancel can free the iterated chanctx and remove it from the list, causing a slab-use-after-free. A guarded...

CVE-2026-46173

CVE-2026-46173 concerns the Linux kernel. The issue arises when an already-exiting task oopses and make_task_dead() calls do_task_dead() with preemption enabled, while __schedule() must be called with preemption disabled. If a preempted oopsing task is still in the dead-state, finish_task_switch(...

CVE-2026-46189

CVE-2026-46189 affects the Linux kernel RDMA pvrdma component (pvrdma_alloc_ucontext). The issue is a double free: pvrdma_uar_free() is invoked in pvrdma_dealloc_ucontext() and is erroneously called before, creating a double free condition. Concrete fixes exist in OSV entries for multiple distrib...

CVE-2026-46253

In Linux kernel pstore/ram, CVE-2026-46253, the vulnerability is a heap buffer overflow during persistent_ram_save_old(). If the buffer size has grown since the first allocation, the code updates old_log_size to the new size and then copies with memcpy_fromio(), risking an out-of-bounds write (an...

CVE-2026-46299

CVE-2026-46299 (Linux kernel) affects the hfsplus filesystem during mount. hfsplus_fill_super() calls hfs_find_init() to initialize a search structure, which grabs tree->tree_lock. If hfsplus_cat_build_key() fails, control jumps to out_put_root without releasing the lock, causing a later clean...

CVE-2026-52917

Summary (concrete details from provided sources): CVE-2026-52917 fixes a Linux kernel SCTP diagnostics flaw in the sock_diag lookup during the dump_one path. The issue occurs when an SCTP association has been freed but is still being reported, allowing the code to dereference an invalid associati...

CVE-2026-53384

The CVE-2026-53384 issue affects the Linux kernel driver for 8250 serial ports (dw8250). During dw8250_probe(), serial8250_register_8250_port() registers the 8250 port and, if a clock exists, attempts to register a clock notifier. If clk_notifier_register() fails, the probe returns an error but d...

CVE-1999-0460

CVE-1999-0460 describes a buffer overflow in the Linux autofs module triggered by excessively long directory names, allowing local users to cause a denial of service. The available connected documents confirm the affected component (Linux autofs module) and the vulnerability class (buffer overflo...

CVE-2005-1589

The CVE-2005-1589 issue affects the Linux kernel’s pktcdvd (and raw device) ioctl handler. In kernel 2.6.12-rc4 and earlier, pkt_ioctl in pktcdvd.c calls the wrong function when issuing an ioctl to the block device, which can leak kernel address space to user space. This local-privilege scenario ...

CVE-2005-4635

CVE-2005-4635 affects the Linux kernel via nl_fib_input in fib_frontend.c, where lack of validation for header and payload lengths allows remote attackers to trigger a denial of service (invalid memory reference) with malformed fib_lookup netlink messages. Affected lineage is kernels before 2.6.1...

CVE-2006-0554

CVE-2006-0554 affects the Linux kernel 2.6.x prior to 2.6.15.5. The vulnerability arises in the XFS ftruncate call, where a crafted operation can cause the kernel to return stale data, enabling local information disclosure. Reported as a local, user-privilege‑required issue, with no remote execut...

CVE-2006-1624

The CVE-2006-1624 entry concerns the Linux sysklogd package (syslogd) where the default configuration does not enable the -x option (disable name lookups). This enables remote attackers to induce a denial of service via traffic amplification using messages with spoofed source IP addresses. The av...

CVE-2006-2446

CVE-2006-2446 describes a race condition between kfree_skb and __skb_unlink in Linux kernel socket buffer handling (Linux kernel 2.6.9 and possibly others) that can allow remote attackers to cause a denial of service (crash) as demonstrated by TCP stress tests in the LTP suite. Connected document...

CVE-2007-0822

CVE-2007-0822 describes a local-denial crash in umount when run on Linux kernel 2.6.15 with Slackware 10.2, triggered by passing a pathname to a USB pen drive that was mounted and then removed; this can lead to a NULL dereference and potential exposure of sensitive data such as core contents. Mul...

CVE-2007-0997

CVE-2007-0997 describes a race condition in the Linux kernel 2.6.17 through 2.6.17.6 affecting the tee (sys_tee) system call. The issue could allow local users to cause a denial of service (system crash), obtain sensitive information (kernel memory contents), or gain privileges via unspecified ve...

CVE-2008-3077

The CVE-2008-3077 issue affects the Linux kernel (arch/x86/kernel/ptrace.c) on x86_64 before version 2.6.25.10. The function sys32_ptrace leaks task_struct references, enabling local attackers to trigger a denial of service (system crash) and potentially other impacts via unknown vectors, possibl...

CVE-2009-1527

CVE-2009-1527 affects the Linux kernel prior to 2.6.30-rc4, where a race condition in ptrace_attach (kernel/ptrace.c) can let local users escalate privileges during an exec that launches a setuid process. The root cause is locking of an incorrect cred_exec_mutex object, enabling a PTRACE_ATTACH p...

CVE-2010-1446

CVE-2010-1446 affects KGDB in the Linux kernel on PowerPC, where arch/powerpc/mm/fsl_booke_mmu.c does not perform a proper security check for access to a kernel page. Local users could overwrite arbitrary kernel memory. The vulnerability is noted across multiple advisories (e.g., Debian DSA-2053-...

CVE-2011-2208

The CVE-2011-2208 vulnerability affects the Linux kernel on the Alpha platform, caused by an integer signedness error in osf_getdomainname in arch/alpha/kernel/osf_sys.c. It allows local users to access sensitive kernel memory. Impact is limited to local exploitation with partial confidentiality ...

CVE-2013-3233

CVE-2013-3233 affects the Linux kernel NFC subsystem: llcp_sock_recvmsg in net/nfc/llcp/sock.c does not initialize a length variable and a data structure, enabling local users to leak kernel-stack information via crafted recvmsg/recvfrom calls. The flaw is in kernels before 3.9-rc7. Impact is loc...

CVE-2016-8398

CVE-2016-8398 affects Android on kernels up to 3.18, where unauthenticated NAS messages can be processed by the UE when no EPS security context exists. This is a network-exploitable issue (no user interaction) with high impact to confidentiality, integrity, and availability (CVSSv3: AV:N/AC:L/PR:...

CVE-2016-8465

CVE-2016-8465 is an elevation-of-privilege vulnerability in the Broadcom Wi‑Fi driver that could let a local malicious app execute code in the kernel. Documents confirm the issue affects Android devices (kernel 3.10/3.18) and that exploitation requires a privileged process, with current mitigatio...

CVE-2017-0327

CVE-2017-0327 affects the NVIDIA crypto driver in the Android/Tegr­a kernel. The connected document notes that the vulnerability arises because an input buffer is copied to an output buffer without validating the input size, which may lead to memory corruption and a denial of service (the NVIDIA ...

CVE-2017-0442

CVE-2017-0442 describes an elevation-of-privilege in the Qualcomm Wi‑Fi driver on Android, allowing a local malicious app to execute arbitrary code in the kernel context. The vulnerability, affecting Android devices with Qualcomm Wi‑Fi components, is mitigated by requiring compromise of a privile...

CVE-2017-0444

CVE-2017-0444 is a local elevation-of-privilege issue in the Realtek sound driver affecting Android devices (kernel 3.10). Connected sources (e.g., CNVD, NVD entries) describe exploitation that allows a locally executed, malicious application to run code in the kernel context via the Realtek driv...

CVE-2017-0453

CVE-2017-0453 : Elevation of privilege in the Qualcomm Wi‑Fi driver could allow a local malicious Android application to execute arbitrary code in the kernel context. Affected: Android on Kernel-3.10. First an attack requires compromising a privileged process. CVSS metrics indicate high impact an...

CVE-2017-0606

CVE-2017-0606 is an elevation-of-privilege flaw in the Qualcomm sound driver affecting Android kernels 3.10 and 3.18. The vulnerability could allow a local malicious app to execute arbitrary code in the kernel context via the Qualcomm sound subsystem (e.g., /dev/voice_svc driver). The issue is cl...

CVE-2017-0611

CVE-2017-0611 is an elevation of privilege in the Qualcomm sound driver on Android that could allow a local attacker to run code in kernel context. Affected: Android devices using Kernel-3.10 and Kernel-3.18 (Android ID A-35393841). The entry is listed in multiple sources (NVD/NVD list and CVE re...

CVE-2017-0623

CVE-2017-0623 describes an elevation-of-privilege vulnerability in the HTC bootloader that could allow a local malicious app to execute arbitrary code within the bootloader context. Affected software is Android on Kernel-3.18, with device-specific impact noted for Pixel and Pixel XL in the CVE li...

CVE-2017-8071

CVE-2017-8071 affects the Linux kernel: the file drivers/hid/hid-cp2112.c in 4.9.x before 4.9.9 uses a spinlock that does not account for sleeping during a USB HID request callback, allowing a local attacker to cause a denial of service via deadlock. The vulnerability is specific to the HID CP210...

CVE-2022-3630

The CVE-2022-3630 entry concerns the Linux kernel, specifically the fs/fscache/cookie.c component used by IPsec. The vulnerability is described as a memory leak resulting from a manipulation in that code path. A patch is recommended to fix the issue, and the vulnerability is associated with VDB-2...

CVE-2022-49805

CVE-2022-49805 – Linux kernel (lan966x): The issue occurs in lan966x_stats_init(), which calls create_singlethread_workqueue() without validating the return value. If it returns NULL, a later queue_delayed_work path dereferences a null workqueue pointer, causing a null-pointer dereference. The re...

CVE-2022-50394

CVE-2022-50394 affects the Linux kernel i2c subsystem (specifically the ismt ioctl path in the ismt_access() function). The vulnerability arises when the driver does not validate user-supplied data, allowing an oversized data->block[0] to trigger an out-of-bounds read, as demonstrated by the k...

CVE-2023-20662

The CVE-2023-20662 entry describes a vulnerability in the wlan component where an integer overflow causes an out-of-bounds write. This could enable local escalation of privilege with SYSTEM-level execution privileges and requires no user interaction. A patch is identified as ALPS07560765 (Issue A...

CVE-2023-53247

CVE-2023-53247 involves the Linux kernel Btrfs code (btrfs_cont_expand path). The issue arises when a page is retrieved during btrfs_cont_expand, then marked as mapped and read; if release_folio() is called before reacquiring the page lock, release_folio() may clear the page private flag but leav...

CVE-2024-57909

CVE-2024-57909 – Linux kernel iio bh1745 information leak : The vulnerability occurs in the IIO light driver (bh1745) where the ‘scan’ local struct used to push data to userspace from a triggered buffer is not initialized for inactive channels, since the code only uses iio_for_each_active_channel...

CVE-2025-38082

CVE-2025-38082 refers to a Linux kernel vulnerability in gpio: virtuser where an out-of-bounds write could occur if a caller wrote more characters than the destination buffer could hold in simple_write_to_buffer. The issue is mitigated by a fix that truncates the input size to the available buffe...

CVE-2025-38223

CVE-2025-38223 : Linux kernel fix for a kernel BUG triggered by an encrypted inode with an unaligned file size (e.g., 33K or 1K) in Ceph-related code paths. The issue manifests as a kernel OOPS/crash via a bug in ceph_msg_data_cursor_init in net/ceph/messenger.c during ceph_con_workfn processing,...

CVE-2025-38372

The CVE-2025-38372 entry concerns the Linux kernel: RDMA/mlx5 implicit ODP handling with unsafe xarray access due to __xa_store() and __xa_erase() being used without proper locking. The patch replaces them with xa_store() and xa_erase(), which perform the required locking internally, addressing a...

CVE-2025-38469

Technical details for CVE-2025-38469 are not publicly provided in the supplied documents; monitor for updates.

CVE-2025-38581

CVE-2025-38581 affects the Linux kernel crypto CCP driver. When CONFIG_CRYPTO_DEV_CCP_DEBUGFS is enabled, rebinding the CCP device could crash the kernel due to a NULL-dereference in debugfs setup. The connected Unity Linux/UTSA advisory notes a patch that fixes this by setting ccp_debugfs_dir to...

CVE-2025-38610

CVE-2025-38610 affects the Linux kernel powercap codebase, specifically the dtpm_cpu path. The vulnerability is caused by a NULL dereference in get_pd_power_uw() when em_cpu_get() returns NULL, which can occur if a CPU becomes unavailable at runtime and get_cpu_device() yields NULL, propagating t...

CVE-2025-38652

CVE-2025-38652: In the Linux kernel, a f2fs path handling bug can cause out-of-bounds access when constructing devs.path for a device, due to sbi->devs.path[] not leaving space for the trailing null terminator. Root cause: device path storage (path[MAX_PATH_LEN]) can be fully filled, causing p...

CVE-2025-38737

CVE-2025-38737 affects the Linux kernel CIFS/smb3 code. The issue is a crash (an oops) caused by an uninitialised variable in smb3_init_transform_rq(), where netfs_alloc_folioq_buffer() is called with an undefined buffer. The fix initialises the buffer to NULL before the call so that netfs starts...

CVE-2025-39929

The CVE-2025-39929 issue is in the Linux kernel SMB client, specifically the smbd_negotiate() path in fs/smb/client/smbdirect.c, where a memory leak can occur if an error path triggers the leak (objects left on __kmem_cache_shutdown()). This memory leak can impact availability. Public advisories ...

CVE-2025-71304

CVE-2025-71304 — Linux kernel Smack DOI handling : The issue arises when writing to /smack/doi with a value previously used, which can disable networking for non-ambient labels. This can lead to privilege escalation, DoS, or information leaks. Debian/RootOS OSV notes indicate patches exist (e.g.,...

CVE-2026-23284

Technical details for CVE-2026-23284 are not publicly provided in the supplied documents; none of the connected advisories describe affected product/version or fix for this CVE. Monitor for updates.

CVE-2026-31663

The CVE-2026-31663 vulnerability affects the Linux kernel xfrm subsystem, where a race between asynchronous crypto completion and device teardown could lead to using a freed dev reference. The fix changes the reference handling: the dev ref is no longer released on async resume entry and is inste...

CVE-2026-43036

Summary (CVE-2026-43036) : The issue resides in the Linux kernel networking path, where gso_features_check() read IPv4 header offsets (iph->frag_off) in a way that could dereference uninitialized data when packets are injected via PF_PACKET paths. The root cause is unsafe header dereferencing ...