CVE-2026-46089

CVE-2026-46089: The Linux kernel zram discard path fails to endio for partial discard requests, causing blkdiscard to hang indefinitely. Fixes jump to end_bio and call bio_endio; CVSS v3.1 base 5.5 (Local, Low complexity). Public disclosures in NVD/NASL entries reference kernel commits addressing...

CVE-2026-46125

CVE-2026-46125 describes a Linux kernel issue in the wifi mac80211 path where, if Multi-Link Operation (MLO) connection preparation fails, the associated station may not be removed correctly. The advisory states that the interface is reset to non-MLD and the station linked to the vif should be de...

CVE-2026-46130

CVE-2026-46130 concerns the Linux kernel’s dm-verity-fec component. The root cause is an incorrect assumption about parity data layout: when reading parity bytes across blocks, parity bytes for the first RS codeword can be split across parity blocks, causing an out-of-bounds read under certain no...

CVE-2026-46220

CVE-2026-46220 affects the Linux kernel’s drm/amdgpu sdma4 fence emission. The vulnerability stems from two BUG_ON(addr & 0x3) assertions in sdma_v4_0_ring_emit_fence(), which could be triggered by unprivileged userspace submissions via DRM_IOCTL_AMDGPU_CS, causing a kernel panic in a scheduler w...

CVE-2026-46285

CVE-2026-46285 : In the Linux kernel, the mtd/docg3 release path has a use-after-free: docg3 is obtained from cascade->floors[0]->priv, then freed by doc_release_device() before the loop completes, and later code dereferences docg3 via docg3->cascade->bch. The root cause is using a fr...

CVE-2026-53152

CVE-2026-53152 affects the Linux kernel dw_mmc-rockchip driver. Older RK SoCs (rk2928, rk3066, rk3188) lacked required private data, leading to NULL-pointer dereferences when the init code accessed missing phase/driver data. The vulnerability is resolved by the commit ff6f0286c896, which adds the...

CVE-2026-53346

CVE-2026-53346 relates to the Linux kernel on arm64 where a rustc bug prevents -Cforce-unwind-tables=y from applying the uwtable annotation to the module, only to individual functions. Consequently, compiler-generated constructors (e.g., asan.module_ctor) lack uwtable metadata. When CONFIG_UNWIND...

CVE-2026-64046

CVE-2026-64046 concerns a Linux kernel TLS issue where a chain-after-chain in the scatterlist could arise when end = 0 (start != 0). The bug creates a chain link to the content type immediately after the wrap link, and sg_next does not recursively resolve consecutive chain links, making the input...

CVE-2026-64343

CVE-2026-64343 is a use-after-free in the Linux kernel's USB ldusb driver triggered by a race between release() and disconnect(). The root cause is that mutex_unlock() is non-atomic and may access the mutex structure after the lock is released, making it unsuitable for managing object lifetime di...

CVE-2026-64354

The CVE-2026-64354 entry concerns the Linux kernel BPF component, specifically btf_repeat_fields() handling of user-supplied BTF data during BPF_BTF_LOAD. A malformed BTF can trigger an integer overflow when calculating the expanded field count, allowing a heap out-of-bounds write past the fixed ...

CVE-2026-64391

The CVE-2026-64391 issue affects the Linux kernel ksmbd component, where alternate data streams (ADS) stored as xattrs were read/written using current task credentials via VFS xattr paths. The root cause is that ADS I/O did not use the credentials captured when the SMB handle was opened, allowing...

CVE-2026-64450

CVE-2026-64450: In Linux kernel TIPC, a broadcast Gap ACK blocks record could be read out-of-bounds due to a missing check that the record fits in the message data area. The bug occurs when tipc_get_gap_ack_blks() validates the len against ugack/bgack counts but not msg_data_sz(), allowing a reco...

CVE-1999-0400

CVE-1999-0400 affects Linux 2.2.0 where running the ldd command on a core file causes a denial of service. The connected documents confirm the affected component (ldd behavior on core files) and the impact (DoS). No explicit root cause, affected versions beyond Linux 2.2.0 are not detailed here, ...

CVE-1999-0460

CVE-1999-0460 describes a buffer overflow in the Linux autofs module triggered by excessively long directory names, allowing local users to cause a denial of service. The available connected documents confirm the affected component (Linux autofs module) and the vulnerability class (buffer overflo...

CVE-2001-1397

CVE-2001-1397 affects the System V shared memory implementation in the Linux kernel before version 2.2.19. The issue allows attackers to modify recently freed memory within SYSV shared memory. Public sources consistently describe this as a kernel memory handling flaw rather than a user-space vuln...

CVE-2002-2254

The CVE describes a vulnerability in the Linux kernel’s Netfilter/IPTables: the experimental IP packet queuing feature in kernels 2.4 (up to 2.4.19) and 2.5 (up to 2.5.31). If a privileged process exits while traffic is not queued, a later process with the same PID may access network traffic that...

CVE-2004-0812

CVE-2004-0812 describes a local privilege/denial-of-service issue in the Linux kernel before 2.4.23 on AMD64 and Intel EM64T architectures, related to how TSS limits are set up. The vulnerability could allow a local user to crash the system and, in some scenarios, potentially execute arbitrary co...

CVE-2004-2536

Summary of CVE-2004-2536 : The Linux kernel 2.6.x releases up to 2.6.5 contain a fault in the exit_thread path (process.c) where per-TSS io_bitmap pointers are not invalidated when a process obtains IO permissions via ioperm and later exits. This can allow other processes to access the per-TSS po...

CVE-2005-0204

CVE-2005-0204 affects the Linux kernel prior to 2.6.9 on AMD64/EM64T, where local users could exploit the OUTS instruction to write to privileged IO ports. The issue is documented in multiple advisories (RHSA-2005:293, SUSE CVE-2005-0204) and CentOS/CentOS-announce and is addressed by kernel secu...

CVE-2005-0207

CVE-2005-0207 corresponds to an unknown vulnerability in Linux kernel 2.4.x, 2.5.x, and 2.6.x where NFS clients can trigger a denial of service via NFS client O_DIRECT error handling. The issue is documented in multiple advisories (RHSA-2005:366 / CESA-2005:366) and CentOS/Ubuntu/NVD entries. Aff...

CVE-2005-1764

CVE-2005-1764 is a kernel vulnerability affecting Linux 2.6 on 64-bit x86 (x86_64). The issue arises because the 47‑bit address page guard is not used, leaving the system vulnerable to local DoS via AMD K8 bug exploitation. Documents confirm the flaw and note that updates/patches were released (e...

CVE-2005-2617

The CVE-2005-2617 entry describes a vulnerability in Linux kernel 2.6.12 and later on 64-bit x86 where syscall32_setup_pages (syscall32.c) does not check the return value of insert_vm_struct. This can allow local users to trigger a memory leak via a crafted 32‑bit ELF header. Affected component: ...

CVE-2006-0555

Vulnerability: CVE-2006-0555 affects the Linux kernel prior to 2.6.15.5, where NFS client operations using O_DIRECT can cause the kernel to panic and crash (local denial of service). Affected product is the Linux kernel; root cause relates to direct I/O handling for NFS. Public advisories from Re...

CVE-2006-1624

The CVE-2006-1624 entry concerns the Linux sysklogd package (syslogd) where the default configuration does not enable the -x option (disable name lookups). This enables remote attackers to induce a denial of service via traffic amplification using messages with spoofed source IP addresses. The av...

CVE-2006-3635

CVE-2006-3635 concerns the Linux kernel ia64 subsystem prior to 2.6.26. The vulnerability arises from mishandling of invalid Register Stack Engine (RSE) state, enabling a local attacker to trigger a denial of service through stack consumption, potentially crashing the system. The issue is limited...

CVE-2006-5331

CVE-2006-5331 affects the Linux kernel on 64-bit PowerPC systems. The altivec_unavailable_exception function mishandles the path where CONFIG_ALTIVEC is defined and the CPU supports Altivec, but Altivec support was not detected by the kernel, enabling a local user to trigger an Altivec instructio...

CVE-2007-3732

The CVE-2007-3732 issue affects Linux 2.6 up to before 2.6.23, involving the TRACE_IRQS_ON function in iret_exc. The root cause is calling a C function without ensuring that processor segments are correctly set, specifically failing to restore the kernel %fs before the call and before enabling in...

CVE-2007-4774

CVE-2007-4774 concerns the Linux kernel prior to 2.4.36-rc1, where a race condition can bypass systrace policies by flooding a ptraced process with SIGCONT signals, potentially waking a PTRACED process. The documentation consistently describes this as a policy bypass rather than a broader impact ...

CVE-2017-0330

CVE-2017-0330 affects NVIDIA’s Tegra kernel via the NVIDIA crypto driver. The connected NVIDIA security bulletin details that the vulnerability arises from a user-supplied pointer not being correctly validated in the crypto driver, potentially enabling denial of service or privilege escalation. A...

CVE-2017-0331

CVE-2017-0331 (NVIDIA Tegra kernel driver, NVMAP): An elevation-of-privilege/DoS issue where untrusted data can change between validation and use, potentially allowing a local attacker to escalate privileges or cause kernel-state impact. Affected context references Android on kernel 3.10 and the ...

CVE-2017-0339

CVE-2017-0339 is an NVIDIA Tegra crypto-dev driver IOCTL handling vulnerability. The issue arises when a value is passed to the kernel driver without proper validation, potentially causing array index issues. Affected are NVIDIA Tegra-based platforms running Linux for Tegra in Android, notably Je...

CVE-2017-0462

CVE-2017-0462 describes an elevation-of-privilege vulnerability in the Qualcomm Seemp driver that could allow a local malicious Android application to execute arbitrary code in the kernel context. Affected product is Android with Kernel-3.18; Android ID A-33353601. The base impact is high, requir...

CVE-2017-0564

CVE-2017-0564 relates to an Elevation of Privilege in the Android kernel ION subsystem. The issue could allow a local malicious app to execute code with kernel privileges (local EoP). Affected are Android kernels 3.10 and 3.18. Public documents identify the kernel ION subsystem as the vulnerable ...

CVE-2017-0574

CVE-2017-0574 describes an elevation-of-privilege vulnerability in the Broadcom Wi‑Fi driver on Android. The issue could allow a local malicious application to execute arbitrary code in the kernel context by exploiting the Wi‑Fi driver, with the Android platform and kernel versions specified as K...

CVE-2017-8066

Affected software/component: Linux kernel drivers/net/can/usb/gs_usb.c in 4.9.x and 4.10.x prior to 4.10.2. Root cause: Interaction with CONFIG_VMAP_STACK allows a local attacker to cause a denial of service or memory corruption by leveraging multiple virtual pages for a DMA scatterlist. Impact: ...

CVE-2022-49970

CVE-2022-49970 concerns a Linux kernel vulnerability in the bpf/cgroup path, where an invalid opcode triggers a kernel BUG during purge_effective_progs when detaching BPF programs from nested cgroups. Reproduction steps described in multiple sources involve attaching prog2 to cg2, prog1 to cg1, w...

CVE-2022-50386

CVE-2022-50386 is a Linux kernel Bluetooth L2CAP use‑after‑free vulnerability. The fix adds a guard by calling l2cap_chan_hold_unless_zero() after __l2cap_get_chan_blah() to prevent a use‑after‑free in l2cap_chan_destroy. Affected: Linux kernel Bluetooth L2CAP path; impact per sources is high (CV...

CVE-2023-53331

Summary (CVE-2023-53331) : In the Linux kernel, the pstore/ram path could treat an empty prz as valid during init, allowing a start value equal to zero to bypass bounds checks and trigger out-of-bounds writes, potentially causing panics in multiple code paths (e.g., sysdump_panic_event, panic, do...

CVE-2023-53354

The CVE-2023-53354 issue affects the Linux kernel, specifically skb_segment() in net/core/skbuff.c. A bug caused by calling skb_orphan_frags() before zero-copy handling can update nrfrags and leave frag pointing to stale values, leading to a NULL pointer dereference and kernel panic in the GSO pa...

CVE-2023-53377

Technical details for CVE-2023-53377 are not publicly provided in the supplied Connected documents. The materials only show the vulnerability description without explicit affected products/versions or remediation specifics. Monitor for official disclosures.

CVE-2023-53424

Technical details for CVE-2023-53424 are not publicly provided in the connected documents; only the fix note (mediatk clk memory leak) is echoed. Monitor upstream advisories for specifics on affected products, versions, and remediation.

CVE-2023-53513

The CVE-2023-53513 issue is a Linux kernel vulnerability where incomplete validation of the nbd ioctl arg can trigger an i_size overflow when the arg is coerced to int (arg cast in nbd_ioctl /nbd_add_socket). The root cause is insufficient validation of large ioctl arguments, allowing an overflow...

CVE-2023-54321

CVE-2023-54321: Linux kernel driver core path (device_add) fix for a null pointer dereference in the error path. If dev->driver is set and bus_remove_device() is invoked before the device is bound, access to dev->p->knode_driver can dereference a NULL pointer. The fix is to clear dev-&gt...

CVE-2024-57909

CVE-2024-57909 – Linux kernel iio bh1745 information leak : The vulnerability occurs in the IIO light driver (bh1745) where the ‘scan’ local struct used to push data to userspace from a triggered buffer is not initialized for inactive channels, since the code only uses iio_for_each_active_channel...

CVE-2024-58000

CVE-2024-58000 affects the Linux kernel Io_uring reg-wait path. The root cause is speculative execution on a kernel array indexed by user input when using ENTER_EXT_ARG_REG, which could interpret an offset into a pre-mapped memory region as an argument. The documented fix is to prevent speculativ...

CVE-2025-21952

CVE-2025-21952 relates to the Linux kernel and affects the corsair-void subsystem. The issue occurs when corsair_void_process_receiver is invoked from an interrupt context, where it previously locked battery_mutex, risking a kernel panic. The fix relocates the critical section into its own work i...

CVE-2025-38176

In Linux kernel, binder: fix use-after-free in binderfs_evict_inode() is the root cause of the vulnerability. The issue occurs within binderfs_evict_inode, leading to potential slab-use-after-free conditions observable under stress-ng with binderfs, and is mitigated by the referenced patch fix. C...

CVE-2025-38258

The CVE-2025-38258 issue affects the Linux kernel, specifically in mm/damon/sysfs-schemes where memcg_path_store() assigns a newly allocated buffer to filter->memcg_path without freeing the previous one, enabling kernel memory leaks via repeated writes to memcg_path in the DAMOS sysfs file. Th...

CVE-2025-38267

CVE-2025-38267 affects the Linux kernel ring-buffer logic. The issue arises during memory-mapped buffer reads when a commit_overrun allows the reader page to swap to the commit buffer, potentially triggering a WARN_ON_ONCE due to missed events. The vulnerability is tied to the ring_buffer_map_get...

CVE-2025-38308

CVE-2025-38308 affects the Linux kernel ASoC Intel AVS path during hardware initialization. The root cause is a potential null pointer dereference in avs_dai_find_path_template(); the fix drops the search since the template is already known when avs_hw_constraints_init() fires. Affected/impacted:...