CVE-2013-3302

The CVE-2013-3302 entry refers to a race condition in the Linux kernel’s CIFS transport path: smb_send_rqst in fs/cifs/transport.c, exploitable on affected kernels prior to 3.7.2. The vulnerability can allow local users to trigger a NULL pointer dereference and OOPS, with potential unspecified im...

CVE-2025-38520

In CVE-2025-38520, the Linux kernel’s DRM/AMDKFD path could deadlock during MMU notifier callbacks when a process exits, potentially leaking VRAM. The root cause was calling mmput from the MMU notifier callback, risking release of the mm struct and exit_mmap/free_pgtable. The fix takes a non-zero...

CVE-2025-39701

Technical details for CVE-2025-39701 are not provided in the supplied documents. Monitor official kernel advisories for affected versions, impact, and remediation, as available information in connected sources is not detailed for this CVE.

CVE-2025-39795

CVE-2025-39795 involves a kernel block layer (blk_stack_limits) overflow where chunk_sectors could exceed an unsigned int when interpreted in bytes. The concrete fix, documented in multiple advisories (e.g., Ubuntu USN entries and Oracle/Linux ELSA/DLA), changes the validation to operate on secto...

CVE-2025-39883

CVE-2025-39883 affects the Linux kernel memory-management path mm/memory-failure, where unpoisoning memory can trigger VM_BUG_ON_PAGE(PagePoisoned(page)) due to checking PG_HWPoison flags on an uninitialized page. The root cause described in the initial and connected advisories is the uninitializ...

CVE-2025-39964

In CVE-2025-39964, the Linux kernel’s crypto/af_alg implementation now disallows concurrent writes to the same af_alg socket. The root cause is a race in af_alg_sendmsg where two writes could interleave or corrupt internal state; a new ctx->write field enforces exclusive ownership for writing....

CVE-2025-71074

CVE-2025-71074 concerns the Linux kernel’s functionfs subsystem, where a race between open and removal can leave a freed object referenced by file->private_data. The root cause is the way ffs->opened is updated; using atomic_dec_and_test() vs atomic_add_return() leads to a window where an o...

CVE-2026-23066

CVE-2026-23066 concerns the Linux kernel RXRPC receive path. The issue arises in rxrpc_recvmsg() where, if MSG_DONTWAIT is requested and the front of the recvmsg queue has its mutex held, the call is unconditionally requeued, potentially corrupting the recvmsg queue and causing Use-After-Frees or...

CVE-2026-23394

CVE-2026-23394 – af_unix GC race with MSG_PEEK (Linux kernel) : A race between MSG_PEEK and garbage collection can cause the GC to incorrectly GC dead sockets, since MSG_PEEK silently bumps a file refcount. The issue originates from a change in the current GC algorithm and the removal of the lock...

CVE-2026-31657

CVE-2026-31657 affects the Linux kernel batman-adv component. The flaw arises when batman-adv’s batadv_bla_add_claim() can replace claim->backbone_gw and drop the old gateway’s final reference while readers still follow the pointer. The netlink claim dump path dereferences claim->backbone_g...

CVE-2026-43049

CVE-2026-43049 affects the Linux kernel HID logitech-hidpp driver (Logitech G920 force feedback). If force feedback init fails, resources may be torn down inconsistently, enabling a use-after-free (UAF) if userspace still references dangling objects. The fixed approach chose to warn but return su...

CVE-2026-45843

CVE-2026-45843 affects the Linux kernel’s SLIP/VJ-compressed TCP header handling (slip and slhc_uncompress). The vulnerability stems from decode() and pull16() not enforcing bounds against the packet end, and decode() masking its return value to 0xFFFF, causing potential over-reads when a compres...

CVE-2026-46032

Summary: CVE-2026-46032 relates to Linux kernel KVM nSVM, where a failed restore of L1 host CR3 during a nested VMEXIT could leave L1 with corrupted state and trigger a triple fault instead of a clean recovery. The fix removes the nested_svm_vmexit return value and ensures proper cleanup, resulti...

CVE-2026-46189

CVE-2026-46189 affects the Linux kernel RDMA pvrdma component (pvrdma_alloc_ucontext). The issue is a double free: pvrdma_uar_free() is invoked in pvrdma_dealloc_ucontext() and is erroneously called before, creating a double free condition. Concrete fixes exist in OSV entries for multiple distrib...

CVE-2026-46238

CVE-2026-46238 affects the Linux kernel’s BAT IV implementation via the batman-adv subsystem. The issue stems from caching an auxiliary originator pointer derived from a temporary lookup in neigh_node state, where the pointer can be freed or become stale after purge handling. The documented fix i...

CVE-2026-46315

CVE-2026-46315 affects the Linux kernel’s io_uring waitid path. The issue arises because IORING_OP_WAITID stores results in io_waitid::info and may copy stale data to userspace if the wait completes without a child event. The fix is to clear the result storage during prep so the kernel’s path mir...

CVE-2026-52914

In the Linux kernel, the batman-adv component is affected by CVE-2026-52914. The root cause is an accounting bug where the accumulated fragment length used for validating queued fragment chains can be truncated during updates. This allows malformed fragment chains to bypass validation and drive r...

CVE-2026-53059

The CVE-2026-53059 issue is a Linux kernel dm-log out-of-bounds write caused by an unsigned 32-bit region_count in create_log_context() overflowing when dm_sector_div_up() returns a 64-bit value. Large region_space can truncate bitset_size, causing clean_bits, sync_bits, and recovering_bits to be...

CVE-2026-53216

The CVE-2026-53216 issue affects the Linux kernel mvpp2 XDP path. Short pool buffers can be smaller than PAGE_SIZE, yet XDP initially sets every xdp_buff frame size to PAGE_SIZE. The XDP helpers then use frame_sz to validate tail growth, which, with an oversized frame, can allow bpf_xdp_adjust_ta...

CVE-2026-53246

CVE-2026-53246 : In the Linux kernel SCTP implementation, a vulnerability exists in how COOKIE_ECHO payloads are processed. The cached peer INIT chunk embedded after the cookie could have its header length inflated without proper validation, allowing the parameter walk (via sctp_walk_params/sctp_...

CVE-1999-0782

KDE kppp is affected by CVE-1999-0782. Local users can create a directory in an arbitrary location by manipulating the HOME environment variable. The core issue is the use of HOME to determine user directories, enabling an attacker with local access to create files/directories outside their inten...

CVE-1999-1442

The CVE-1999-1442 entry describes a bug in AMD K6 processors running Linux 2.0.x and 2.1.x kernels where a specific sequence of instructions can be used by a local attacker to trigger a denial of service (kernel crash). Affected component: AMD K6 processor in these Linux kernel versions; root cau...

CVE-2001-1273

The CVE-2001-1273 issue affects the Linux kernel before version 2.2.17-14 when running on certain Intel CPUs. The vulnerability, described as the 'mxcsr P4' issue, allows a local user to cause a denial of service (system halt). Documents do not specify the exact vulnerable components beyond the k...

CVE-2007-5087

The CVE-2007-5087 issue affects the Linux kernel ATM module prior to 2.4.35.3 with CLIP support enabled. Reading /proc/net/atm/arp before the CLIP module is loaded can cause a denial-of-service (kernel panic) for local users. The vulnerability is documented in multiple sources (NVD/SUSE/Red Hat) ...

CVE-2008-3686

The CVE-2008-3686 entry concerns Linux kernel 2.6.26-rc4 and 2.6.26.x where the rt6_fill_node function in net/ipv6/route.c is vulnerable. Local users can trigger a denial of service (kernel OOPS) by sending IPv6 requests when no IPv6 input device is in use, causing a NULL pointer dereference. The...

CVE-2016-10286

CVE-2016-10286 is an elevation-of-privilege vulnerability in the Qualcomm video driver on Android, enabling a local malicious application to execute arbitrary code in the kernel context. The issue affects Android with Kernel-3.18 and Android ID A-35400904; exploitation requires compromising a pri...

CVE-2016-10294

CVE-2016-10294 describes a local information-disclosure vulnerability in the Qualcomm power driver used in Android. The issue could allow a local malicious application to access data outside its permission levels by exploiting the Qualcomm power driver in affected Android kernels (Kernel-3.10 and...

CVE-2016-6781

CVE-2016-6781 describes an Elevation of Privilege in the MediaTek driver affecting Android on kernel 3.10. The vulnerability could allow a local malicious application to execute arbitrary code in the kernel context after compromising a privileged process. The NVD entry lists the impact as High wi...

CVE-2016-6790

CVE-2016-6790 affects NVIDIA libomx (libnvomx) in Android devices (notably Pixel C) with kernel 3.18. Root cause: NVIDIA OpenMAX component copies an input buffer to an output buffer without validating the input size, enabling local exploitation; the NVIDIA bulletin labels this as a high‑severity ...

CVE-2016-8444

CVE-2016-8444 is an elevation of privilege vulnerability in the Qualcomm camera that could allow a local malicious app to execute arbitrary code in the kernel context on Android (Kernel-3.10). The flaw requires compromising a privileged process, and the description identifies Android as the produ...

CVE-2017-0629

CVE-2017-0629 is an information-disclosure vulnerability in the Qualcomm camera driver for Android, enabling a local malicious app to access data outside its permissions after compromising a privileged process. Affected: Android kernels 3.10/3.18 (Qualcomm camera driver). Base impact: partial con...

CVE-2022-50107

CVE-2022-50107 concerns a Linux kernel vulnerability in the CIFS/fscache path where, if the index == next_cached case is hit, a refcount on the struct page could leak. The fix implemented is to switch to readahead_folio(), which manages the refcount automatically. Affected component: Linux kernel...

CVE-2022-50269

CVE-2022-50269 affects the Linux kernel (drm/vkms). Root cause: vkms_init() allocates a config with kmalloc and may leak if vkms_create() fails, since the return value isn’t checked before exiting. Impact: local attacker could cause memory leak during vkms module initialization. The fixed descrip...

CVE-2023-20677

The CVE-2023-20677 issue affects the wlan component in MediaTek-based devices, caused by a missing bounds check leading to an out-of-bounds read. Impact is local information disclosure with SYSTEM-level execution privileges required, and exploitation reportedly does not require user interaction. ...

CVE-2023-53377

Technical details for CVE-2023-53377 are not publicly provided in the supplied Connected documents. The materials only show the vulnerability description without explicit affected products/versions or remediation specifics. Monitor for official disclosures.

CVE-2025-21822

CVE-2025-21822: Technical details are not publicly provided in the supplied documents. Monitor for updates.

CVE-2025-38050

CVE-2025-38050 affects the Linux kernel hugetlb memory management. A race between __update_and_free_hugetlb_folio() and replace_free_hugepage_folios() can cause folio_hstate(folio) to see a NULL pointer, leading to a kernel NULL pointer dereference and crash. The description explains the root cau...

CVE-2025-38069

Technical details for CVE-2025-38069 are not provided in the connected documents. Monitor for updates from upstream advisories.

CVE-2025-38228

CVE-2025-38228: In the Linux kernel, a memory leak could occur in the media/imagination driver during e5010_probe(). The fix ensures memory allocated by video_device_alloc() is released if an error path is taken by adding video_device_release() in the failure handling path. This addresses leaked ...

CVE-2025-38281

Public technical details about CVE-2025-38281 are not provided in the connected documents. The available descriptions indicate a NULL check addition in mt7996_thermal_init for Linux kernel wifi mt76 mt7996, but no further specifics.

CVE-2025-38294

The CVE-2025-38294 entry concerns the Linux kernel wifi driver ath12k. The vulnerability arises when ath12k_mac_assign_vif_to_vdev() fails, causing a NULL radio handle (ar) to be dereferenced during debug logging via arvif, which is invalid in fail scenarios where the radio handle is NULL. The fi...

CVE-2025-38314

CVE-2025-38314 is a Linux kernel vulnerability affecting virtio-pci. The issue arises in virtio_pci_admin_dev_parts_get(), where the result_sg_size is filled with the length from virtqueue_get_buf(), inadvertently including an 8-byte status, causing oversized transfer data and potential kernel bu...

CVE-2025-38388

CVE-2025-38388 concerns the Linux kernel’s ARM Firmware Framework for ARMv8-A (FFA). The issue stems from using a mutex to protect the notifier hashtable accesses, which could sleep in atomic context and trigger warnings like “sleeping function called from invalid context.” Connected documents co...

CVE-2025-38407

CVE-2025-38407 (Linux kernel, RISC‑V) is addressed by replacing the dynamic percpu boot data area with a statically allocated array in the kernel image to fix boot on NUMA SMP configurations. The root cause was that, when percpu page allocation happens early with NUMA, percpu data could be placed...

CVE-2025-38454

CVE-2025-38454: In the Linux kernel, ALSA: ad1816a: Fix potential NULL pointer deref in snd_card_ad1816a_pnp(); switches to pr_warn() when 'pdev' is NULL to avoid NULL pointer dereference. The description indicates the fix is kernel-side and targets the ad1816A soundcard driver; no details on aff...

CVE-2025-38484

Technical details about CVE-2025-38484 are not provided in the supplied connected documents. The references list the CVE but do not describe affected components, impact, or fixes. Monitor vendor advisories for public details and remediation.

CVE-2025-38510

The CVE-2025-38510 issue in the Linux kernel is about the KASAN memory debugger. The fix removes kasan_find_vm_area() to avoid deadlocks during KASAN reporting when find_vm_area() would be called in an atomic_context. The vulnerability stemmed from a potential deadlock between kernel VM area repo...

CVE-2025-38537

CVE-2025-38537: Linux kernel vulnerability in net: phy: Don’t register LEDs for genphy. Root cause: when a PHY has no driver, the genphy driver is probed/removed via phy_attach/detach, and if the PHY node has a leds subnode, LEDs get (un)registered during genphy probe/remove, leading to a determi...

CVE-2025-38542

CVE-2025-38542 affects the Linux kernel net:appletalk code. The vulnerability is a device refcount leak in atrtr_create(): during route entry updates, the old device reference was not released before assigning the new one, leading to a leak. The fix releases the old reference with dev_put() befor...

CVE-2025-38621

The CVE-2025-38621 issue affects the Linux kernel md subsystem, where md_spares_need_change could call rdev_addable() while under RCU, potentially dereferencing an rdev.mddev that is NULL after release, causing a NULL pointer dereference and a panic. The published description notes the fix is to ...