CVE-2016-8391

CVE-2016-8391 is an elevation-of-privilege in the Qualcomm sound driver on Android kernels (3.10, 3.18) that could allow a local malicious app to execute arbitrary kernel code. The issue requires compromising a privileged process. Public exploit details are not provided in the documents. The Andr...

CVE-2016-8406

CVE-2016-8406 describes a local information-disclosure vulnerability in Android kernel components (ION subsystem, Binder, USB driver, networking) that could allow a malicious local app to access data outside its permission levels. The issue is tied to Android kernels (3.10, 3.18) and is character...

CVE-2016-8440

CVE-2016-8440 details (Android kernel 3.18): A buffer overflow in the SMMU system call, caused by improper input validation in the ADSP SID2CB system call, may lead to hypervisor memory overwrite. The vulnerability affects Android on Kernel 3.18 and is described with a high-severity impact (poten...

CVE-2017-0334

CVE-2017-0334 is an information-disclosure vulnerability in the NVIDIA GPU driver affecting Android on kernel 3.18 (Android ID A-33245849) where a local malicious app could access data outside its permission levels. The provided documents state the issue is an information disclosure with high imp...

CVE-2017-0438

CVE-2017-0438 is a local elevation-of-privilege issue in the Qualcomm Wi‑Fi driver for Android, enabling a local malicious app to run code in the kernel context. The vulnerability is tied to the Qualcomm Wi‑Fi stack and is listed under Android kernel versions 3.10 and 3.18 with Android IDs A-3240...

CVE-2017-0459

CVE-2017-0459 describes an information-disclosure vulnerability in the Qualcomm Wi‑Fi driver on Android (kernel 3.18). The flaw could allow a local malicious application to access data outside its permissions, and is categorized as Moderate because exploitation requires compromising a privileged ...

CVE-2017-0535

CVE-2017-0535 is an information disclosure in the HTC sound codec driver for Android hosted on Kernel-3.10. The issue permits a local attacker, after compromising a privileged process, to access data outside its permissions, implying a confidentiality risk limited to the affected kernel/device co...

CVE-2017-0614

CVE-2017-0614 describes an elevation of privilege in the Qualcomm Secure Execution Environment Communicator driver on Android. The issue could allow a local malicious application to execute arbitrary code in the kernel context. Affected software/components: Android devices using Kernel-3.10 and K...

CVE-2017-0634

CVE-2017-0634 is an information-disclosure vulnerability in the Synaptics touchscreen driver on Android, affecting Kernel-3.18. The issue allows a local malicious process to access data outside its permissions after bypassing privileged process protection. Impact is limited to the Synaptics drive...

CVE-2022-50130

CVE-2022-50130 concerns the Linux kernel staging fbtft: core: set smem_len before fb_deferred_io_init call. In fbtft_framebuffer_alloc(), fb_deferred_io_init() was invoked before initializing info->fix.smem_len, which was zeroed by framebuffer_alloc() and caused a WARN_ON() at init, resulting ...

CVE-2022-50224

CVE-2022-50224 is a Linux kernel/KVM issue where NX is treated as a valid SPTE bit for NPT, enabling a mismatch that can trigger a WARN when reserved SPTE bits are set. Concrete details come from the Linux kernel KVM/mmu path, including a traceback and a mitigation involving NX handling when the ...

CVE-2023-20663

CVE-2023-20663 describes a potential out-of-bounds write in wlan due to an integer overflow, enabling local privilege escalation with System execution privileges required and no user interaction. The vulnerability is tied to a patch ID ALPS07560741 / Issue ID ALPS07560741. Connected sources menti...

CVE-2023-53431

CVE-2023-53431 : Linux kernel vulnerability in the SCSI SES enclosure handling. The issue occurs when an enclosure has only a primary component (no secondary components) and previously caused binding/enclosure processing to bail, potentially contributing to crashes during iSCSI session disconnect...

CVE-2023-53442

Technical details about CVE-2023-53442 are not present in the provided connected documents. The SUSE/Tenable entries reference kernel fixes in general but do not disclose affected products/versions or specific exploit vectors here. Monitor for official patch specifics.

CVE-2023-53531

CVE-2023-53531 affects the Linux kernel’s null_blk poll timeout handling. The provided details describe a race between null_timeout_rq() and null_poll() that can cause a NULL pointer dereference (address 0x8) and kernel panic during io_uring benchmarks on /dev/nullb0. The root cause is a race in ...

CVE-2024-57927

CVE-2024-57927 relates to the Linux kernel’s NFS write-to-cache path. The root cause was that nfs_netfs_init_request() could be invoked with a NULL file pointer when netfslib copied freshly read data into a write request for the cache, causing an oops via nfs_file_open_context(). The fix prevents...

CVE-2025-21747

The CVE-2025-21747 entry concerns the Linux kernel DRM AST driver (drm/ast: astdp) where the video-signal enable path could trigger a kernel warning due to an insufficient timeout. Root cause: a timeout too short (200 ms) for enabling the ASTDP transmitter; the system may log a WARN_ON in ast_dp_...

CVE-2025-38255

CVE-2025-38255 : In the Linux kernel, a NULL pointer dereference can occur in lib/group_cpus when group_cpus_evenly() is called with numgrps == 0. The root cause is that kcalloc() returns ZERO_SIZE_PTR and subsequent dereference leads to a panic during blk_mq_map_queues/nulL_map_queues. The conne...

CVE-2025-38301

CVE-2025-38301 affects the Linux kernel nvmem driver for zynqmp_nvmem; root cause: the driver expected a device pointer in context but nvmem_config.priv is never set, causing NULL pointer dereferences when accessing the device. A fix was committed to restore correct context handling (commit 29be4...

CVE-2025-38318

CVE-2025-38318: In the Linux kernel, the perf/arm-ni driver missed a call path, missing platform_set_drvdata() in arm_ni_probe(), which caused platform_get_drvdata() to return NULL in remove. The SUSE advisory and OpenVAS references confirm this specific fix was applied to address the arm-ni PMU,...

CVE-2025-38368

CVE-2025-38368 concerns the Linux kernel fix for a NULL dereference in the tps6594-pfsm subsystem. The issue arises in the misc: tps6594-pfsm driver where devm_kasprintf() could return NULL for pfsm->miscdev.name. The patch adds a NULL pointer check in tps6594_pfsm_probe() to prevent dereferen...

CVE-2025-38390

CVE-2025-38390 relates to the Linux kernel firmware/arm_ffa notifier callbacks. The issue arises from allocating and inserting a notifier callback node into a hashtable during registration, but during unregistration the code only removes the node from the hashtable without freeing the allocated m...

CVE-2025-38529

CVE-2025-38529 relates to the Linux kernel Comedi driver (aio_iiro_16) where an unchecked userspace-derived value in it->options[1] could cause a shift out of bounds or negative shift; the fix adds a bounds check on it->options[1] before evaluating the (1 <options[1]) & 0xdcfc test. Affe...

CVE-2025-38530

CVE-2025-38530 relates to the Linux kernel’s Comedi pcl812 code. The vulnerability arises from a test that shifts a constant with a user-supplied option: (1 <options[1]) & board->irq_bits. Since it->options[1] is unchecked from userspace, the shift amount can be negative or out of bounds...

CVE-2025-38660

Summary: In the Linux kernel, the vulnerability in the Ceph code path arises because parse_longname() uses strrchr() without a guaranteed NUL-terminated string. This leads to improper handling when building arguments with kmemdup_nul() for kstrtou64(), since the string copy may not be NUL-termina...

CVE-2025-38699

CVE-2025-38699 is a Linux kernel double-free fix in the SCSI bfad (bfa) path. When bfad_im_probe() fails during init, bfad->im is freed but not set to NULL. If the driver is later uninstalled and bfad_sm_stopping triggers bfad_im_probe_undo(), the memory at bfad->im can be freed again, enab...

CVE-2025-38702

The CVE-2025-38702 entry concerns the Linux kernel fbdev subsystem. The issue is a potential buffer overflow in do_register_framebuffer() when unregistration creates NULL gaps in registered_fb[], when all slots become occupied despite num_registered_fb

CVE-2025-38731

CVE-2025-38731: In the Linux kernel, the drm/xe driver fixes a double-free in xe_vm_bind_ioctl when an array bind argument check fails. The bug freed bind_ops twice; the fix nulls bind_ops after freeing to prevent a second free. Root cause: double-free in xe_vm_bind_ioctl+0x1b2/0x21f0 (KASAN repo...

CVE-2025-39694

The CVE-2025-39694 entry concerns the Linux kernel component s390/sclp. The vulnerability arises from an improper NULL pointer check in the SCCB present check logic used during interrupt handling: the NULL check is performed after physical-to-virtual address translation, and if the kernel identit...

CVE-2025-39813

CVE-2025-39813 concerns the Linux kernel ftrace subsystem. A race between ftrace_dump() and trace_pipe reads could trigger WARN_ON_ONCE in trace_printk_seq() when trace data is consumed by other readers, causing iter.seq to be mispopulated. The documented fix moves the trace_printk_seq() call ins...

CVE-2025-39844

CVE-2025-39844 relates to a Linux kernel memory-management bug where page-table synchronization was not consistently performed when vmemmap spans multiple PGD entries. The issue caused intermittent boot failures and a kernel panic (notably on 4-level paging with large persistent memory) due to a ...

CVE-2025-39849

CVE-2025-39849 refers to a Linux kernel vulnerability in the wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() path. The issue allows memory corruption if ssid->datalen exceeds IEEE80211_MAX_SSID_LEN (32) due to missing bounds checks. The connected documents confirm this CVE ...

CVE-2026-22980

The CVE-2026-22980 issue is confirmed to affect the Linux kernel and is addressed by a patch that fixes a race between v4_end_grace writes and server shutdown. The fix introduces two new fields in the nfsd network context: client_tracking_active (protected by nn->client_lock) and grace_end_for...

CVE-2026-23089

CVE-2026-23089 is a Linux-kernel issue in ALSA USB-audio: use-after-free in snd_usb_mixer_free() when mixer creation fails, causing freed mixer control memory to be referenced by callbacks during card registration. The connected advisories confirm the root cause and state the fix is to remove all...

CVE-2026-23233

CVE-2026-23233 covers a Linux kernel f2fs bug where swapfile mapping can go wrong when the first extent is unaligned and the swapfile is small (

CVE-2026-23300

The CVE-2026-23300 issue is a Linux kernel vulnerability in IPv6 routing where creating a standalone nexthop object (e.g., ip -6 nexthop add id 100 dev lo) caused a crash when later referenced by an IPv4 route. Root cause: fib6_nh_init() incorrectly treated such nexthops as rejects due to an abse...

CVE-2026-23394

CVE-2026-23394 – af_unix GC race with MSG_PEEK (Linux kernel) : A race between MSG_PEEK and garbage collection can cause the GC to incorrectly GC dead sockets, since MSG_PEEK silently bumps a file refcount. The issue originates from a change in the current GC algorithm and the removal of the lock...

CVE-2026-23448

Vulnerability summary (CVE-2026-23448). In the Linux kernel, the net: usb: cdc_ncm path has a bounds-check defect related to NDP16/DPE16 processing. The function cdc_ncm_rx_verify_ndp16() correctly accounts for the NDP offset in the first check, but the second check ignores ndpoffset when validat...

CVE-2026-31677

The CVE-2026-31677 issue affects the Linux kernel af_alg path. The root cause is that af_alg_get_rsgl() could extract RX scatterlist data beyond the remaining receive budget, allowing a local attacker to trigger a DoS via recvmsg when there isn’t enough RX space for a chunk. The fix tightens budg...

CVE-2026-31754

The CVE-2026-31754 issue affects the Linux kernel’s USB DRD/CDNS3 gadget path. When cdns3_gadget_start() fails, the DRD hardware remains in gadget mode while software state is INACTIVE, causing hardware/software state inconsistency. This can lead to a failed host-mode switch via sysfs (role switc...

CVE-2026-43110

CVE-2026-43110 concerns the Linux kernel brcmfmac Wi‑Fi driver. The issue arises when processing firmware interface (IF) events: the code validates the firmware-provided interface index but still uses the raw bsscfgidx as an array index without a matching range check, enabling out-of-bounds acces...

CVE-2026-43120

In the Linux kernel RDMA/irdma driver, CVE-2026-43120 describes a double-free during rereg_user_mr when IB_MR_REREG_TRANS is set. If the trans reg path fails after allocating a new umem, the code releases it but fails to NULL the iwmr->region, causing ib_umem_release to be invoked again during...

CVE-2026-43190

The CVE-2026-43190 issue affects the Linux kernel netfilter xt_tcpmss TCP option parser. The root cause is reading op[i+1] without validating the remaining option length, which can cause an out-of-bounds read when i+1 == optlen. This could access memory past the option boundary (stack buffer _opt...

CVE-2026-45866

The CVE-2026-45866 case concerns a use-after-free in the Linux kernel caif_serial ldisc path. A race between ldisc_close() and packet transmission can cause handle_tx() to access ser->tty after the tty is freed, due to tty_kref_put() being invoked in ldisc_close() while the network device may ...

CVE-2026-45991

The CVE-2026-45991 entry concerns the Linux kernel UDF filesystem. The root cause is in handle_partition_descriptor() where partition descriptors are deduplicated by partition number, but appended slots do not record partnum, allowing repeated Partition Descriptors to accumulate and grow num_part...

CVE-2026-46110

CVE-2026-46110 affects the Linux kernel stmmac driver. When RX memory is exhausted, stmmac_rx() could misinterpret descriptors (full vs dirty), risking a NULL pointer dereference and potential kernel panic. The fix adds an explicit check to bail out when the next RX descriptor is dirty before adv...

CVE-2026-46130

CVE-2026-46130 concerns the Linux kernel’s dm-verity-fec component. The root cause is an incorrect assumption about parity data layout: when reading parity bytes across blocks, parity bytes for the first RS codeword can be split across parity blocks, causing an out-of-bounds read under certain no...

CVE-2026-46133

The CVE-2026-46133 issue affects Linux kernel’s Soft RoCE (RDMA/rxe) where an unauthenticated UDP packet with an unknown opcode could trigger an out-of-bounds read during ICRC/CRC processing due to missing validation of opcodes before length arithmetic. The advisory describes that entries in the ...

CVE-2026-46182

The CVE-2026-46182 issue affects the Linux kernel component pseries/papr-hvpipe . The root cause is that a local kernel stack variable hdr (papr_hvpipe_hdr) is allocated on the stack and only hdr.version and hdr.flags are initialized, leaving reserved padding bytes uninitialized. When copied to u...

CVE-2026-46218

The vulnerability CVE-2026-46218 affects the Linux kernel DRM AMDGPU driver. The issue is in ib_get_value/ib_set_value where the uvd/vce/vcn code accessed the Instruction Buffer (IB) at predefined offsets without verifying the IB size, enabling out-of-bounds reads/writes. The root cause is missin...