CVE-2026-46166

The CVE-2026-46166 affects the Linux kernel’s wireless subsystem (mac80211) in the radar detect work. The root cause is unsafe list iteration during radar processing, where ieee80211_dfs_cac_cancel can free the iterated chanctx and remove it from the list, causing a slab-use-after-free. A guarded...

CVE-2026-45839

CVE-2026-45839 is a Linux kernel vulnerability where negative CO-RE accessor indices in bpf_core_parse_spec() could cause an out-of-bounds read, leading to a deterministic kernel crash during BPF program load on systems with CONFIG_DEBUG_INFO_BTF=y. The issue arises because sscanf parses componen...

CVE-2026-45840

CVE-2026-45840 : The vulnerability in the Linux kernel openvswitch path allows a CAP_NET_ADMIN user to overflow the vport netlink reply buffer by providing a large upcall PID array, triggering a -EMSGSIZE and a kernel BUG. The root cause is ovs_vport_set_upcall_portids() accepting any non-zero mu...

CVE-2026-45944

CVE-2026-45944 affects the Linux kernel IOMMU VT-d. During context-entry teardown, the implementation zeros a 128‑bit entry in two 64‑bit writes, risking a torn entry where the Present bit remains set while other fields are zeroed, potentially causing unpredictable behavior or spurious faults. Th...

CVE-2026-46120

Concrete details found: CVE-2026-46120 affects the Linux kernel ip6_gre machinery. The issue is in ip6erspan_changelink(), which wrongly uses dev_net(dev) instead of the correct per-netns hash resolved by link_net, after a patch series that fixed per-netns resolution in ip6erspan_newlink(). This ...

CVE-2026-46191

CVE-2026-46191 concerns the Linux kernel fbcon component: when console rotation fails during fbcon_rotate_font(), the font buffer may overflow due to an OOB access. The fix clears the font buffer if the reallocation during console rotation fails and ensures the rotated buffer does not overflow. D...

CVE-2026-52912

The CVE-2026-52912 affects the Linux kernel netfilter nf_queue handling of bridge LOCAL_IN traffic. br_pass_frame_up() rewrites skb->dev from the ingress port to the bridge master before queueing, allowing a queued bridge packet to retain a freed bridge master in skb->dev. On reinjection, b...

CVE-2026-52931

CVE-2026-52931 — Linux kernel (batman-adv tp_meter): The vulnerability arises when batadv_tp_recv_ack() or batadv_tp_stop() are invoked with a tp_vars in the BATADV_TP_RECEIVER role. In that case, code paths access sender-only members that were never initialized, causing undefined behavior. The f...

CVE-2026-53036

The CVE-2026-53036 issue concerns the Linux kernel BPF JIT on ARM64. check_imm(bits, imm) erroneously allowed a signed N-bit range of [-2^N, 2^N), effectively giving an (N+1)-bit range, which permits values in [2^18, 2^19) for imm19 (and similarly for imm26) to slip through. This caused potential...

CVE-2026-53254

The CVE-2026-53254 issue affects the Linux kernel Bluetooth RFCOMM MCC handlers, which cast skb data to protocol-specific structs without validating skb->len. A malicious remote device could send truncated MCC frames, causing out-of-bounds reads. The fix is to validate and access required data...

CVE-2026-53266

The CVE-2026-53266 entry concerns the Linux kernel netfilter bridge path, where ebt_snat ARP sender hardware address rewrite could be performed on non-writable memory. Root cause: ARP SHA is written via skb_store_bits() relative to skb->data, and skb_header_pointer() only safely reads the ARP ...

CVE-2026-63797

The CVE-2026-63797 fix addresses a use-after-free in the Linux kernel rpmsg character device path. If rpmsg_chrdev_eptdev_add() fails after rpmsg_chrdev_probe() stores the new eptdev in the default endpoint’s priv pointer, the eptdev may be freed while callbacks still access the stale priv. The p...

CVE-2026-64279

CVE-2026-64279 concerns the Linux kernel i2c core: a race in adapter deregistration where an adapter may be accessed after resources are freed. The fix removes the adapter from the IDR before tearing it down during deregistration or on registration failure to prevent use-after-free of resources s...

CVE-2026-64389

Summary: CVE-2026-64389 affects the Linux kernel KSMD (ksmbd) SMB3 multichannel binding path. The code derives the NTLMv2 session key into sess->sess_key during ksmbd_auth_ntlmv2(), before validating the NTLMv2 response. If authentication fails, the subsequent KEY_XCH step may still use the (p...

CVE-2026-64450

CVE-2026-64450: In Linux kernel TIPC, a broadcast Gap ACK blocks record could be read out-of-bounds due to a missing check that the record fits in the message data area. The bug occurs when tipc_get_gap_ack_blks() validates the len against ugack/bgack counts but not msg_data_sz(), allowing a reco...

CVE-1999-0195

Summary (CVE-1999-0195) : This is a DoS in the RPC portmapper where attackers can register/unregister RPC services or spoof services using a spoofed source IP (e.g., 127.0.0.1). Multiple connected records corroborate the behaviour, including Red Hat and SUSE advisories. The exact affected product...

CVE-1999-0401

CVE-1999-0401 describes a race condition in Linux kernel 2.2.1 that allows local users to read arbitrary memory from /proc files. The vulnerability arises from a race in the /proc handling in Linux 2.2.1, enabling partial/possible disclosure of memory contents to unprivileged local users. Affecte...

CVE-1999-0804

CVE-1999-0804 affects Linux 2.2.x kernels, where the vulnerability lies in ICMP handling. Malformed ICMP packets with unusual types, codes and IP header lengths can cause a denial of service. The NVD CVSS v2 base score is 5.0 (Medium), with network attack vector, low attack complexity, and partia...

CVE-2000-0227

The CVE-2000-0227 entry concerns the Linux 2.2.x kernel where the number of Unix domain sockets is not restricted by the wmem_max parameter. This allows a local attacker to cause a denial of service by requesting a large number of sockets. The linked sources confirm the affected platform and vuln...

CVE-2000-0344

The CVE-2000-0344 entry affects the knfsd NFS server in Linux kernel 2.2.x. The vulnerability is a denial of service triggered by a negative size value, exploitable by remote attackers. The available sources confirm the affected component and the impact (denial of service) but do not provide expl...

CVE-2001-1551

Summary: CVE-2001-1551 affects the Linux kernel 2.2.19. The issue arises because CAP_SYS_RESOURCE is enabled for setuid processes, allowing local users to exceed disk quota restrictions during execution of setuid programs. What’s affected: Linux kernel 2.2.19 (setuid/process context). Impact (as ...

CVE-2002-1319

The CVE-2002-1319 issue affects the Linux kernel on x86, specifically versions 2.4.20 and earlier and 2.5.x. The root cause is a flaw in emulation mode where TF and NT EFLAGS are not properly cleared, enabling a local user to cause a denial of service (hang). The impact is a local DoS without rem...

CVE-2004-0596

The vulnerability CVE-2004-0596 affects the Equalizer Load-balancer for serial network interfaces (eql.c) in Linux kernel 2.6.x up to 2.6.7. The root cause is a null dereference triggered when a non-existent device name is used, leading to local denial of service. Affected component: eql.c within...

CVE-2007-3720

The CVE-2007-3720 entry describes a vulnerability in the Linux kernel 2.4 process scheduler that uses CPU billing from periodic sampling ticks. This design allows local users to cause a denial of service (CPU consumption) by calling voluntary nanosecond sleeps, making the process inactive during ...

CVE-2007-3732

The CVE-2007-3732 issue affects Linux 2.6 up to before 2.6.23, involving the TRACE_IRQS_ON function in iret_exc. The root cause is calling a C function without ensuring that processor segments are correctly set, specifically failing to restore the kernel %fs before the call and before enabling in...

CVE-2008-3911

The CVE-2008-3911 issue affects the Linux kernel 2.6.26.3, specifically the proc_do_xprt function in net/sunrpc/sysctl.c, which does not validate the length of a user-supplied buffer when reading /proc/sys/sunrpc/transports. This can allow local users to overflow a stack-based buffer and cause un...

CVE-2009-3043

The CVE-2009-3043 entry affects Linux kernel 2.6.31-rc before 2.6.31-rc8. The tty_ldisc_hangup function in drivers/char/tty_ldisc.c allows local users to trigger a denial of service (system crash, sometimes with a NULL pointer dereference) and may enable privilege escalation via certain pseudo-te...

CVE-2011-4112

CVE-2011-4112 affects the Linux kernel net subsystem prior to 3.1. The issue arises from improper restriction of the IFF_TX_SKB_SHARING flag, enabling local users with CAP_NET_ADMIN to access /proc/net/pktgen/pgctrl and, using the pktgen package with a bridge device for a VLAN interface, trigger ...

CVE-2016-6756

CVE-2016-6756 describes an information-disclosure vulnerability affecting Qualcomm components (including the camera driver and video driver) on Android. The issue could allow a local malicious application to access data outside its permission level, with root cause tied to a privileged-process co...

CVE-2016-8427

CVE-2016-8427 affects the NVIDIA Tegra kernel driver (NVHOST). The connected NVIDIA bulletin entry for CVE-2016-8427 notes a memory-after-free vulnerability in NVHOST that can lead to denial of service or escalation of privileges, enabling a local attacker to execute code in kernel context. The i...

CVE-2016-8443

CVE-2016-8443 details (from provided documents): Android kernel 3.18 vulnerability that could allow possible unauthorized memory access in the hypervisor. The issue arises from an incorrect configuration that provides access to subsystem page tables. Affected product: Android; kernel version: 3.1...

CVE-2016-8457

CVE-2016-8457 is a vulnerability in the Broadcom Wi‑Fi driver on Android. It enables a local, malicious application to gain elevated privileges by executing arbitrary code in the kernel context. The issue requires compromising a privileged process and is classified as High severity (CVSSv3.0: Loc...

CVE-2016-8459

CVE-2016-8459 (Android) describes a possible buffer overflow in the storage subsystem, triggered by bad parameters in RPMB listener responses. The issue affects Android kernel 3.18 and is associated with the RPMB command handling, potentially leading to a write/overflow condition in kernel memory...

CVE-2016-8481

CVE-2016-8481 describes an elevation of privilege vulnerability in the Qualcomm sound driver on Android. A local malicious application could potentially execute arbitrary code in the kernel context if it first compromises a privileged process. The issue affects Android devices with affected kerne...

CVE-2017-0333

CVE-2017-0333 : An elevation of privilege in the NVIDIA GPU driver could allow a local malicious Android process to run arbitrary code in the kernel context on devices with Kernel-3.18. This could lead to a local permanent compromise and may require reflashing the OS to repair the device. The pro...

CVE-2017-0338

CVE-2017-0338 describes an elevation-of-privilege vulnerability in the NVIDIA GPU driver affecting Android devices with Kernel-3.18. A local malicious application could run code in the kernel context, leading to a potentially permanent device compromise that may require reflashing the OS. Exploit...

CVE-2017-0526

CVE-2017-0526 describes an elevation-of-privilege vulnerability in the HTC Sensor Hub Driver affecting Android on Kernel-3.10. The issue could allow a local, malicious application to execute arbitrary code within the kernel context after compromising a privileged process. The Android ID is A-3389...

CVE-2017-0533

CVE-2017-0533 corresponds to an information-disclosure vulnerability in the Qualcomm video driver on Android (kernel 3.18). The issue could allow a local malicious app to access data beyond its permissions, requiring initial compromise of a privileged process and user interaction per CVSS3 metric...

CVE-2017-0583

CVE-2017-0583 describes an elevation of privilege vulnerability in the Qualcomm CP access driver on Android, enabling a local malicious application to execute arbitrary code in the kernel context. Affected components include the Qualcomm CP access driver within Android kernel versions such as 3.1...

CVE-2017-0608

CVE-2017-0608 is an elevation-of-privilege in the Qualcomm kernel sound driver for Android, enabling a local attacker to run arbitrary code in the kernel context. The flaw requires compromising a privileged process first. Affected software/versions include Android on Kernel-3.10 and Kernel-3.18. ...

CVE-2017-0623

CVE-2017-0623 describes an elevation-of-privilege vulnerability in the HTC bootloader that could allow a local malicious app to execute arbitrary code within the bootloader context. Affected software is Android on Kernel-3.18, with device-specific impact noted for Pixel and Pixel XL in the CVE li...

CVE-2017-8070

CVE-2017-8070 affects the Linux kernel 4.9.x prior to 4.9.11. The issue is in drivers/net/usb/catc.c where interaction with CONFIG_VMAP_STACK allows a local user to trigger denial of service (system crash or memory corruption) by exploiting use of more than one virtual page for a DMA scatterlist....

CVE-2022-49849

CVE-2022-49849 fixes a Linux kernel flaw in the Btrfs dev_args_match_device path. When devid is set to (u64)-1 via ioctl, the match of devid may be skipped and device matching may succeed incorrectly. The issue was introduced by a patch that added the function used to match devices; the two match...

CVE-2022-50307

In CVE-2022-50307, the Linux kernel s390/cio subsystem had an out-of-bounds read during cio_ignore free scans. The bug arose from an optimization that excluded online devices from scans, incorrectly assuming I/O-subchannel drvdata pointed to a private struct, which is invalid for devices bound to...

CVE-2023-53361

CVE-2023-53361 affects the Linux kernel on LoongArch where pmd_leaf() was not defined, causing a panic in ksm06 during LTP tests (Huge page pmd to pte_present). The issue is resolved by adding LoongArch-specific p?d_leaf() definitions (as per commits referenced in the CVE description). The connec...

CVE-2024-43874

CVE-2024-43874 affects the Linux kernel crypto CCP/SEV path. The vulnerability is a NULL pointer dereference in __sev_snp_shutdown_locked triggered when psp_device or sev_device are uninitialized due to DEBUG_TEST_DRIVER_REMOVE. The fix returns early from __sev_snp_shutdown_locked() if these stru...

CVE-2024-58042

CVE-2024-58042 relates to the Linux kernel and fixes a potential deadlock in rhashtable growth logic. The original implementation could trigger a deadlock chain involving nested locks between the rhashtable bucket, rq lock, and dsq lock. The fix moves the hash table growth check and work scheduli...

CVE-2024-58065

The CVE-2024-58065 issue concerns the Linux kernel component clk: mmp: pxa1908-apbc. Root cause: the NULL vs IS_ERR() check was incorrect because devm_kzalloc() returns NULL on error, not an error pointer. Die to this, a NULL check fix was applied to properly distinguish allocation failures. The ...

CVE-2025-38156

CVE-2025-38156 is a Linux kernel vulnerability affecting the mt76 wifi driver and specifically the mt7996_mmio_wed_init() path. The root cause is that devm_ioremap() may return NULL on error and mt7996_mmio_wed_init() did not check for this, causing a NULL pointer dereference. Affected: Linux ker...

CVE-2025-38258

The CVE-2025-38258 issue affects the Linux kernel, specifically in mm/damon/sysfs-schemes where memcg_path_store() assigns a newly allocated buffer to filter->memcg_path without freeing the previous one, enabling kernel memory leaks via repeated writes to memcg_path in the DAMOS sysfs file. Th...