CVE-2025-38530

CVE-2025-38530 relates to the Linux kernel’s Comedi pcl812 code. The vulnerability arises from a test that shifts a constant with a user-supplied option: (1 <options[1]) & board->irq_bits. Since it->options[1] is unchecked from userspace, the shift amount can be negative or out of bounds...

CVE-2025-38573

The CVE-2025-38573 issue affects the Linux kernel SPI subsystem, specifically the spi: cs42l43 entry parsing. The root cause is that a device-tree/ software node property list is not terminated with a null, because the count of properties is not specified. If the property entries are unterminated...

CVE-2025-38610

CVE-2025-38610 affects the Linux kernel powercap codebase, specifically the dtpm_cpu path. The vulnerability is caused by a NULL dereference in get_pd_power_uw() when em_cpu_get() returns NULL, which can occur if a CPU becomes unavailable at runtime and get_cpu_device() yields NULL, propagating t...

CVE-2025-38686

CVE-2025-38686 describes a Linux kernel local crash in userfaultfd’s UFFDIO_MOVE when encountering a migration PMD entry. The fix adds a missing check and delegates migration-entry handling to split_huge_pmd(), and removes an unnecessary folio check. Upstream commits (e.g., 7f1101a0a181243ad587ec...

CVE-2025-38737

CVE-2025-38737 affects the Linux kernel CIFS/smb3 code. The issue is a crash (an oops) caused by an uninitialised variable in smb3_init_transform_rq(), where netfs_alloc_folioq_buffer() is called with an undefined buffer. The fix initialises the buffer to NULL before the call so that netfs starts...

CVE-2025-39713

The CVE-2025-39713 entry concerns the Linux kernel media: rainshadow-cec driver, where rain_interrupt() performed a buffer-full check on rain->buf_len before acquiring rain->buf_lock. This TOCTOU race could allow concurrent interrupts to overflow the buffer (DATA_SIZE) by writing beyond cap...

CVE-2025-39809

CVE-2025-39809 affects the Linux kernel’s Intel QuickI2C HID path (intel-thc-hid). The issue is that the ACPI _DSD methods for ICRS/ISUB return data with a trailing byte, making the actual length one byte longer than the structs define. This leads to a stack-out-of-bounds write and a kernel crash...

CVE-2025-39819

CVE-2025-39819 affects the Linux kernel (fs/smb). The issue is an inconsistent refcount update in smb2_compound_op that could leak resources; a fix adds an extra cleanup goto to ensure cfile is dropped on all paths, including ENOMEM paths. The problem is limited to the kernel SMB path and is miti...

CVE-2025-39840

The CVE-2025-39840 in the Linux kernel is a fixed out-of-bounds read in audit_compare_dname_path() when a watch on / coincides with a single-character create under / (e.g., /a). The root cause is that parent_len() returns 1 for "/"; audit_compare_dname_path() can set pathlen to 0 and dereference ...

CVE-2025-39869

CVE-2025-39869: Linux kernel memory allocation bug in dmaengine: ti: edma caused out-of-bounds writes to queue_priority_map due to allocating with sizeof(s8) for a 2D array; manifested as kernel crashes on ARM (BeagleBoard-X15). The issue is fixed by changing the allocation to sizeof(*queue_prior...

CVE-2025-40082

CVE-2025-40082 targets the Linux kernel’s hfsplus code and causes a slab-out-of-bounds read in hfsplus_uni2asc() when listing extended attributes. The issue arises because the expected unicode buffer structure size varies (hfsplus_attr_unistr vs hfsplus_unistr), so a previous fix was insufficient...

CVE-2025-68211

CVE-2025-68211 (Linux kernel, KSM) is addressed by a patch that changes scan_get_next_rmap_item from per-address walking to a range walk using walk_page_range, allowing KSMD to skip unmapped holes in large VMAs. The fix targets inefficiency where KSMD would otherwise scan vast address spaces with...

CVE-2026-23098

CVE-2026-23098 affects the Linux kernel component related to NET/ROM handling in nr_route_frame(). The issue is a double-free: old_skb is freed unconditionally, and if nr_neigh->ax25 is NULL the caller may free old_skb again. The root cause is freeing old_skb without validating the ax25 pointe...

CVE-2026-23171

CVE-2026-23171 is a Linux kernel bonding driver use-after-free bug. It occurs when an enslave failure happens after a new slave is added to the bond’s slave array, risking use-after-free because the new slave could be used before cleanup frees it. The fixed sequence moves the slave-array update t...

CVE-2026-31718

The CVE-2026-31718 entries describe a use-after-free in ksmbd (Linux kernel in-kernel SMB3 server) triggered when a durable file handle survives a session disconnect. The root cause is an asymmetric cleanup of lock state: byte-range locks left on a freed conn->lock_list after fp->conn is nu...

CVE-2026-43036

Summary (CVE-2026-43036) : The issue resides in the Linux kernel networking path, where gso_features_check() read IPv4 header offsets (iph->frag_off) in a way that could dereference uninitialized data when packets are injected via PF_PACKET paths. The root cause is unsafe header dereferencing ...

CVE-2026-43229

The CVE-2026-43229 issue affects the Linux kernel via the chips-media wave5 driver. The root cause is an incorrect device cleanup order: video device unregistration was performed after power/runtime disable and hardware power-down, allowing a kthread worker to read hardware registers after autosu...

CVE-2026-43361

CVE-2026-43361 affects the Linux kernel Btrfs subsystem. The issue arises when snapshotting a previously received subvolume can overflow BTRFS_UUID_KEY_RECEIVED_SUBVOL, causing a transaction abort and putting the filesystem into read-only mode. The vulnerability can be triggered by repeatedly sna...

CVE-2026-43456

CVE-2026-43456 affects the Linux kernel bonding driver. When a non-Ethernet device (e.g., GRE tunnel) is enslaved to a bond, bond_setup_by_slave() copies the slave’s header_ops to the bond device, causing a type confusion in header callbacks (e.g., ipgre_header) that use netdev_priv(dev). The res...

CVE-2026-45839

CVE-2026-45839 is a Linux kernel vulnerability where negative CO-RE accessor indices in bpf_core_parse_spec() could cause an out-of-bounds read, leading to a deterministic kernel crash during BPF program load on systems with CONFIG_DEBUG_INFO_BTF=y. The issue arises because sscanf parses componen...

CVE-2026-46032

Summary: CVE-2026-46032 relates to Linux kernel KVM nSVM, where a failed restore of L1 host CR3 during a nested VMEXIT could leave L1 with corrupted state and trigger a triple fault instead of a clean recovery. The fix removes the nested_svm_vmexit return value and ensures proper cleanup, resulti...

CVE-2026-46088

CVE-2026-46088 affects the Linux kernel (ALSA subsystem). The vulnerability arises in snd_ctl_elem_init_enum_names() where a loop advances through a names buffer using buf_len, and may call fortified strnlen(p, 0) when buf_len reaches zero but items remain. Public documents indicate the fix added...

CVE-2026-46110

CVE-2026-46110 affects the Linux kernel stmmac driver. When RX memory is exhausted, stmmac_rx() could misinterpret descriptors (full vs dirty), risking a NULL pointer dereference and potential kernel panic. The fix adds an explicit check to bail out when the next RX descriptor is dirty before adv...

CVE-2026-46152

CVE-2026-46152 affects the Linux kernel’s wifi/mac80211 subsystem. The root cause is that ieee80211_invoke_fast_rx() uses a static per-invocation rx_result, causing concurrent callers to share a single instance and potentially overwrite results between ieee80211_rx_mesh_data() and the switch on r...

CVE-2026-46260

The CVE-2026-46260 entry is supported by multiple connected sources detailing a kernel IPv6 out-of-bounds read when creating an IPv6 route with RTA_NH_ID, due to fib6_info not containing trailing fib6_nh and an unsafe read of iter->fib6_nh. The fix adds a check of iter->nh before dereferenc...

CVE-2026-46297

CVE-2026-46297 corresponds to a Linux kernel issue in net: libwx regarding VF misc interrupts. The vulnerability arose from using request_threaded_irq() with a primary handler and a NULL threaded handler while setting IRQF_ONESHOT, which triggers a kernel warning (genirq: Warn about using IRQF_ON...

CVE-2026-46330

The CVE-2026-46330 entry concerns the Linux kernel TCP ULP support for SMC. The vulnerability arises when an active TCP socket is converted into an SMC socket by in-place modifications to core VFS structures (struct file, dentry, inode), violating VFS invariants that expect these structures to be...

CVE-2026-53182

CVE-2026-53182 affects the Linux kernel nl80211: rejects oversized EMA RNR lists in nl80211_parse_rnr_elems, using a u8 counter and capping at 255 to align with the underlying data structure. Several advisories (Red Hat, Debian family, Ubuntu OSV entries, and Root) confirm patches are released in...

CVE-2026-53192

CVE-2026-53192 — Linux kernel ALSA timer UAF fix The vulnerability affects the ALSA timer path (snd_timer_user_params) in the Linux kernel. A race can occur during timer object release when a concurrent SNDRV_TIMER_IOCTL_PARAMS ioctl is in flight, potentially leading to a use-after-free if anothe...

CVE-2026-53245

CVE-2026-53245 affects the Linux kernel in net/802/mrp due to a parsing logic error in mrp_pdu_parse_vecattr. The vector-attribute event encoding and valen handling could cause out-of-sync FirstValue processing and misapplication of events, leading to corruption of offsets during PDU parsing and,...

CVE-2026-53262

CVE-2026-53262 affects the Linux kernel ioctl path for the pppol2tp module (l2tp) where pppol2tp_ioctl() dereferenced sock->sk->sk_user_data without proper locking while a sleep could occur during copy_from_user(). If a concurrent socket close happened, l2tp_session_close() could free the s...

CVE-2026-53267

The CVE-2026-53267 entry concerns a Linux kernel netfilter nft_ct use-after-free style issue where a per-CPU template conntrack entry can be treated as a real ct, causing a 16-byte memcpy path to overflow the kernel stack when using NFT_REG32_15. The root cause is that a template ct is not reject...

CVE-2026-53274

CVE-2026-53274 affects the Linux kernel net/smc code. A logic flaw in __smc_setsockopt() allowed a local unprivileged user to cause a Denial of Service by keeping the socket lock held during a copy_from_sockptr() operation. The vulnerability occurs because the copy is performed while holding lock...

CVE-2026-53393

CVE-2026-53393 (Linux kernel, NFS daemon) is resolved in the Linux kernel. The issue was that nfsd_vfs_write() and nfsd_commit() did not rotate the server’s write verifier (nn->writeverf) when deferred writeback errors occurred, unlike other durable-storage-failure paths which call commit_rese...

CVE-2026-64191

The CVE-2026-64191 issue affects the Linux kernel i2c-stub driver (CONFIG_I2C_STUB=m) where I2C_SMBUS_I2C_BLOCK_DATA did not validate data->block[0] against I2C_SMBUS_BLOCK_MAX, allowing out-of-bounds access when an I2C_SMBUS_IOCTL with a block length > 32 is issued. The bug contrasts with ...

CVE-2026-64207

CVE-2026-64207 affects the Linux kernel, specifically the net/sched DualPI2 GSO backlog accounting path. When a GSO skb is split into segments, the code previously counted and propagated an extra backlog to the parent, leaving the parent’s qlen inflated and risking a NULL pointer dereference in q...

CVE-2001-0914

The CVE-2001-0914 issue affects the Linux kernel prior to 2.4.11pre3. It allows local users to cause a denial of service (crash) by starting the core vmlinux kernel, with the root cause described as potentially poor error checking during ELF loading. Publicly available documents name the affected...

CVE-2001-1056

The CVE affects the ip_masq_irc IP masquerading module 2.2. A remote attacker can bypass firewall restrictions by inducing the target to send a DCC SEND to a malicious server listening on port 6667, which may cause the module to treat that traffic as valid and permit the connection to the port sp...

CVE-2001-1398

The CVE-2001-1398 issue affects the Linux kernel prior to 2.2.19, arising from the masquerading code where packet length checks were lax, potentially enabling kernel memory writes via the CPIA driver off-by-one bug. Confirmed in multiple advisories (Mandrake MDKSA-2001:037 and Debian/Debian DSA-0...

CVE-2003-0956

CVE-2003-0956 describes race conditions in the Linux kernel’s O_DIRECT handling prior to 2.4.22. Affected component: kernel I/O path for direct I/O (O_DIRECT) on 2.4.x. Impact: local users could read data from previously deleted files or see data during reads of truncated files, potentially expos...

CVE-2004-0228

CVE-2004-0228 refers to an integer signedness error in the cpufreq /proc handler (cpufreq_procctl) of the Linux 2.6 kernel, enabling local users to escalate privileges to kernel level. The issue is discussed in multiple advisories (e.g., SUSE, Gentoo GLSA 200407-02, Fedora 2004-111) as part of Li...

CVE-2005-0916

CVE-2005-0916 affects the Linux kernel 2.6.11 on PPC64/IA64 with CONFIG_HUGETLB_PAGE enabled. A local user can trigger a denial of service (system panic) by running io_queue_init and exiting without io_queue_release, causing exit_aio and is_hugepage_only_range to fail. Connected sources confirm t...

CVE-2005-2617

The CVE-2005-2617 entry describes a vulnerability in Linux kernel 2.6.12 and later on 64-bit x86 where syscall32_setup_pages (syscall32.c) does not check the return value of insert_vm_struct. This can allow local users to trigger a memory leak via a crafted 32‑bit ELF header. Affected component: ...

CVE-2006-1523

CVE-2006-1523 affects the Linux kernel’s RCU signal handling: the __group_complete_signal function in signal.c may allow local DoS due to an unsafe BUG_ON, guarded by siglock while switch_exit_pids() uses tasklist_lock. Affected version cited is kernel 2.6.16 (and possibly other 2.6.x). The conne...

CVE-2008-0163

The CVE affects Linux kernel 2.6 in vserver setups, where a symlink issue in /proc allows local attackers to access resources across vservers (CVE-2008-0163). Public advisories confirm affected packages and indicate fixes: Debian DSA-1494-1/2 address linux-2.6 vulnerabilities and upgrade to a pat...

CVE-2011-2211

CVE-2011-2211 concerns the Linux kernel on the Alpha architecture. The vulnerability lies in the osf_wait4 function (arch/alpha/kernel/osf_sys.c), where an incorrect pointer is used in versions prior to 2.6.39.4. This can allow local users to gain elevated privileges by writing a specific integer...

CVE-2016-10154

CVE-2016-10154 affects Linux kernel 4.9.x prior to 4.9.1. The smbhash function in fs/cifs/smbencrypt.c interacts incorrectly with CONFIG_VMAP_STACK, enabling local users to trigger a denial of service (system crash or memory corruption) or other unspecified impacts by exploiting use of more than ...

CVE-2016-5870

CVE-2016-5870 concerns the msm_ipc_router_close function in net/ipc_router/ipc_router_socket.c within the ipc_router component of the Linux kernel (3.x), as used in Qualcomm QuIC Android contributions for MSM devices. The vulnerability allows a denial of service via a NULL pointer dereference or ...

CVE-2016-8463

CVE-2016-8463 describes a denial-of-service vulnerability in the Qualcomm FUSE file system used by Android. A remote attacker could trigger a device hang or reboot by delivering a specially crafted file. Affected software includes Android on kernels 3.10 and 3.18. The connected documents do not s...

CVE-2017-0307

Summary (CVE-2017-0307) : A vulnerability in the NVIDIA Tegra kernel DRM driver can trigger an integer overflow while calculating memory to allocate, causing a smaller-than-needed allocation and a potential buffer overflow. This may lead to denial of service or possible privilege escalation withi...