CVE-2025-38679

CVE-2025-38679 – Linux kernel media venus OOB read : The vulnerability is in media: venus where event_seq_changed() processes a firmware property count without validating the payload length, enabling out-of-bounds memory access. Impact: kernel crashes and potential information disclosure if firmw...

CVE-2025-39851

CVE-2025-39851 relates to the Linux kernel VXLAN implementation. Affected scenario is when learning is enabled and an incoming packet attempts to refresh an FDB entry that points to an FDB nexthop group (not a remote destination). This could dereference a non-existent remote and trigger a NULL po...

CVE-2026-31525

CVE-2026-31525 concerns the Linux kernel BPF interpreter’s signed 32-bit division/modulo (sdiv32/smod32). The issue arises from using abs() on s32 operands, which is undefined for S32_MIN, causing incorrect results that can mismatch verifier behavior and enable out-of-bounds map access. A fix int...

CVE-2026-43077

CVE-2026-43077 concerns the Linux kernel crypto/algif_aead path. The vuln arises from a miscalculation of the minimum receive buffer size during decryption because the tag size was not considered in the size check. The fix adds the required extra length to account for the authentication tag, prev...

CVE-2026-43407

The CVE-2026-43407 issue affects the Linux kernel libceph component, where a CEPH_MSG_AUTH_REPLY with a large payload_len could trigger an integer overflow and out-of-bounds read. The root cause is storing payload_len and related lengths in int, allowing negative values to underflow pointers. The...

CVE-2026-45834

CVE-2026-45834 affects the Linux kernel Bluetooth L2CAP path. A NULL pointer dereference in l2cap_sock_state_change_cb() is fixed by adding the NULL guard already present in l2cap_sock_resume_cb() and l2cap_sock_ready_cb(); patch applies to affected kernel versions (e.g., openSUSE/SUSE notes and ...

CVE-2026-46033

The CVE-2026-46033 issue in the Linux kernel crypto/authencesn was fixed: authenc ESN paths require either a zero authsize or an authsize of at least 4 bytes, but a later path could copy digestsize into inst->alg.maxauthsize without validation, allowing ahash digests of 1–3 bytes (e.g., cbcmac...

CVE-2026-46039

CVE-2026-46039 affects the Linux kernel. The root cause is a potential integer overflow in rxgk_extract_token() during the length check. The fix changes the check to round down the size of the available data rather than rounding up, preventing overflow. Kernel commits upstream (listed in referenc...

CVE-2026-46191

CVE-2026-46191 concerns the Linux kernel fbcon component: when console rotation fails during fbcon_rotate_font(), the font buffer may overflow due to an OOB access. The fix clears the font buffer if the reallocation during console rotation fails and ensures the rotated buffer does not overflow. D...

CVE-2026-46225

CVE-2026-46225 concerns the Linux kernel SPI host controller driver (rspi). The issue arises when deregistering the controller: resources such as DMA can be released before proper deregistration, potentially impacting availability. The root cause is captured as “spi: rspi: fix controller deregist...

CVE-2026-46271

CVE-2026-46271 concerns the Linux kernel ath12k Wi‑Fi driver. When a multi‑link connection is active, WoW offloads were enabled on both the primary and secondary links, potentially crashing firmware on WCN7850 devices (denial of service). The fix changes WoW offloads to run only on the primary li...

CVE-2026-46285

CVE-2026-46285 : In the Linux kernel, the mtd/docg3 release path has a use-after-free: docg3 is obtained from cascade->floors[0]->priv, then freed by doc_release_device() before the loop completes, and later code dereferences docg3 via docg3->cascade->bch. The root cause is using a fr...

CVE-2026-46303

The CVE-2026-46303 vulnerability affects the Linux kernel isofs Rock Ridge CE handling. rock_continue() could use rs->cont_extent without validating the block number, allowing potential reads of data from an adjacent filesystem via sb_bread() on crafted ISO mounts. The issue was addressed by p...

CVE-2026-52917

Summary (concrete details from provided sources): CVE-2026-52917 fixes a Linux kernel SCTP diagnostics flaw in the sock_diag lookup during the dump_one path. The issue occurs when an SCTP association has been freed but is still being reported, allowing the code to dereference an invalid associati...

CVE-2026-52934

The CVE-2026-52934 entry involves the Linux kernel’s batman-adv TVLV handling. The root cause is batadv_tvlv_container_list_size() using a 16-bit accumulator, which can wrap when the total size exceeds U16_MAX, causing an undersized allocation in batadv_tvlv_container_ogm_append() and a subsequen...

CVE-2026-53079

CVE-2026-53079 affects the Linux kernel networking path in net_sched. The issue is a memory leak where, during deferred qdisc drops, packets not freed on root qdisc due to missing TCQ_F_DEQUEUE_DROPS handling remain stranded on child to_free lists. The fix makes qdisc_dequeue_drop() fetch and che...

CVE-2026-53175

The CVE-2026-53175 entries describe a use-after-free in the Linux kernel’s fragment reassembly during netns teardown. Root cause: fqdir_pre_exit() flushes fragment queues but may leave freed skbs referenced by fragment queue state (fragments_tail/last_run_head) before INET_FRAG_COMPLETE is set, a...

CVE-2026-53193

CVE-2026-53193 concerns the Linux kernel ALSA timer component. When a snd_timer object is freed via snd_timer_free() while there are still pending snd_timer_instance entries linked to it, slave instances may continue to point at the freed timer, creating a use-after-free condition. The vulnerabil...

CVE-2026-53225

The CVE-2026-53225 entry describes a Linux kernel SCTP vulnerability in __sctp_rcv_asconf_lookup() where an unauthenticated peer can send a truncated ASCONF chunk; the code may read 16 bytes of uninitialized memory past the address parameter when the chunk’s length is misdeclared. Affected compon...

CVE-2026-53335

The CVE-2026-53335 issue concerns the Linux kernel DAMON_LRU_SORT path (mm/damon/lru_sort). The root cause is damon_ctx allocation failure in the init path, which may lead to a NULL ctx passed to damon_commit_ctx() and a NULL pointer dereference. The documented fix is to return -ENOMEM if ctx is ...

CVE-2026-53341

The CVE-2026-53341 issue in the Linux kernel concerns a use-after-free (UAF) in fhandle handling due to unlocked reads of mount::mnt_ns during may_decode_fh(). The race occurs because may_decode_fh() can access mnt_ns without taking locks, allowing the mount to be unmounted and the mnt_namespace ...

CVE-2002-1963

The CVE-2002-1963 entry affects Linux kernel versions 2.4.1–2.4.19. The root cause is that the NR_RESERVED_FILES limit is set to 10, enabling local users to exhaust resources by opening 10 setuid binaries, causing a denial of service. Publicly provided documents confirm the affected kernel range ...

CVE-2006-6333

The CVE-2006-6333 issue affects Linux kernel 2.6.19: the tr_rx function in ibmtr.c can assign the wrong flag to ip_summed, enabling remote attackers to trigger a memory-corruption DoS by crafting packets that mislead the kernel to treat a field as an offset. The vulnerability is supported by mult...

CVE-2013-3236

The CVE-2013-3236 issue affects the Linux kernel component vmci_transport_dgram_dequeue in net/vmw_vsock/vmci_transport.c; it fails to initialize a length variable, allowing local attackers to read kernel stack memory via crafted recvmsg/recvfrom. Affects kernels before 3.9-rc7. Multiple advisori...

CVE-2016-8407

CVE-2016-8407 is an information disclosure vulnerability in Android’s kernel components (ION subsystem, Binder, USB driver, and networking). The issue could allow a local malicious app to access data outside its permission levels after compromising a privileged process. Affected products/versions...

CVE-2016-8450

CVE-2016-8450 is an elevation-of-privilege flaw in the Qualcomm sound driver affecting Android kernel space (Kernel-3.10). The NVD entry describes a local attacker compromising a privileged process to gain code execution in the kernel context. The vulnerability is tied to the Qualcomm sound drive...

CVE-2022-50025

CVE-2022-50025 affects the Linux kernel. It fixes a memory leak in an error path: bitmap_zalloc() allocated in afu_allocate_irqs() must be balanced with a corresponding bitmap_free() in the error handling path. The issue was resolved by correcting the memory management in the afu_allocate_irqs() ...

CVE-2022-50167

Technical details for CVE-2022-50167 are not publicly available in the provided documents. The advisories list the CVE but do not specify affected products, root cause, or fixes. Monitor for official disclosures and updates.

CVE-2022-50230

In the Linux kernel (arm64), the idmap access problem occurred on systems implementing FEAT_EPAN where UXN was not set on swapper page tables, causing idmap_kpti_install_ng_mappings to panic when accessing __idmap_kpti_flag. The issue was fixed upstream by applying UXN to the swapper PTEs as part...

CVE-2022-50233

The CVE-2022-50233 entry pertains to the Linux kernel Bluetooth stack (net/bluetooth/eir.c and net/bluetooth/mgmt.c). The root cause is using strlen on hdev->dev_name and hdev->short_name, which are not guaranteed to be NULL-terminated. This can lead to kernel memory reads when the terminal...

CVE-2022-50373

CVE-2022-50373: Linux kernel patch for fs/dlm lowcomms races. A race between queue_work() in _dlm_lowcomms_commit_msg() and srcu_read_unlock() could let a dlm_msg be freed with msg->idx containing garbage. A fix adds an extra reference count between dlm_lowcomms_new_msg() and dlm_lowcomms_comm...

CVE-2023-53345

CVE-2023-53345 pertains to the Linux kernel, addressing a data race in rxrpc_wait_to_be_connected() where the loop accessed call->error before the call state was checked for completion. The fix ensures call->error is read only after the call is complete, preventing races between rxrpc_send_...

CVE-2023-53397

Technical details about CVE-2023-53397 (Linux kernel modpost off-by-one in is_executable_section) are not publicly available in the provided connected documents. Monitor for updates from vendors/security advisories.

CVE-2023-53406

The CVE-2023-53406 issue affects the Linux kernel’s USB gadget code (pxa25x_udc), where using debugfs_lookup() without balancing dput() could leak memory over time. The advisory describes the root cause as a memory-leak condition and recommends replacing the pattern with debugfs_lookup_and_remove...

CVE-2025-38116

In CVE-2025-38116, the Linux kernel’s ath12k wireless driver suffers a use-after-free (UAF) in the notifier chain when ath12k_core_hw_group_assign() or ath12k_core_hw_group_create() fails; the notifier chain is not unregistered and its memory may be freed after rmmod, risking access to freed noti...

CVE-2025-38179

Technical details about CVE-2025-38179 (affected product/component, root cause, impact, exploitability, or patch information) are not publicly provided in the connected documents. Monitor for updates.

CVE-2025-38308

CVE-2025-38308 affects the Linux kernel ASoC Intel AVS path during hardware initialization. The root cause is a potential null pointer dereference in avs_dai_find_path_template(); the fix drops the search since the template is already known when avs_hw_constraints_init() fires. Affected/impacted:...

CVE-2025-38583

CVE-2025-38583 affects the Linux kernel clk xilinx vcu clock provider. The issue occurs when registration of pll_post fails and the code attempts to unregister it, which can lead to a NULL pointer dereference during clk_hw_unregister calls. The fix is to unregister pll_post only if it was registe...

CVE-2025-38609

CVE-2025-38609 is a Linux kernel vulnerability in the PM/devfreq subsystem where code could dereference governor->name if governor is NULL. The fix, implemented by moving the NULL check before accessing governor->name, updates the handling of the governor to prevent a null pointer exception...

CVE-2025-38646

CVE-2025-38646 exploits a NULL pointer dereference in the Linux kernel’s wifi driver rtW89 during RX processing for packets on an unsupported 6 GHz band. The vulnerability occurs when a problematic RX report makes software think a packet arrived on 6 GHz even though the chip does not support it, ...

CVE-2025-38681

CVE-2025-38681 affects the Linux kernel mm/ptdump code. The issue arises when memory hotplug modifications race with ptdump_walk_pgd() and intermediate page-table frees, causing the ptdump code to dereference freed memory and potentially crash or corrupt data. The fix moves the memory hotplug loc...

CVE-2025-38707

CVE-2025-38707 is a Linux-kernel NTFS3 file-name sanity-check vulnerability. The issue arises from a too-long file name not being validated against the directory-entry size, potentially enabling local escalation when processing NTFS names. The CVE entry in the initial doc shows a HIGH impact with...

CVE-2025-39683

CVE-2025-39683 (Linux kernel tracing vulnerability) The issue occurs when processing long strings in ftrace filters: trace_get_user may fail, but parser->buffer end is not zeroed, leading to a slab-out-of-bounds read in strsep/ftrace_process_regex and related release paths. The result is a loc...

CVE-2025-39782

CVE-2025-39782 concerns the Linux kernel, specifically the JBD2 journal path. The issue arises because jbd2_log_do_checkpoint() and jbd2_journal_shrink_checkpoint_list() contend for j_list_lock, potentially causing long wait times that can trigger softlockups if sleeping calls do not occur. The a...

CVE-2026-23002

CVE-2026-23002 affects the Linux kernel’s buildid path. The fix switches the sleepable context reader to use __kernel_read() for reading file data instead of direct page cache access via read_cache_folio(), reducing the risk of a NULL pointer dereference in filemap_read_folio. The patch keeps exi...

CVE-2026-23154

CVE-2026-23154 concerns the Linux kernel fix for segmentation of forwarding fraglist GRO. The description explains that GRO packets containing a frag_list could be mishandled during GSO segmentation because skb_segment_list cannot correctly process GRO skbs converted by XLAT (which translates onl...

CVE-2026-23440

CVE-2026-23440 is a Linux kernel vulnerability in the net/mlx5e IPSec ESN update path. A race condition could cause the ESN wrap event to be processed twice: after validating the event, the driver updates the kernel xfrm state and the lock is temporarily released, risking incorrect ESN high-order...

CVE-2026-31408

CVE-2026-31408 is a Linux kernel Bluetooth SCO use-after-free in sco_recv_frame(), where conn->sk is accessed after releasing sco_conn_lock() without holding a reference. The fix uses sco_sock_hold() to take a reference before unlocking and adds sock_put() on exit paths. Connected advisories s...

CVE-2026-31448

CVE-2026-31448 concerns the Linux kernel ext4 filesystem. The issue arises on mkdir/mknod when an extent insertion fails and ext4_ext_map_blocks() reclaims blocks without removing corresponding data from the extent tree, allowing the same physical block to be referenced by both directory and xatt...

CVE-2026-31554

The CVE-2026-31554 entry concerns a Linux kernel futex requeue issue: using sys_futex_requeue() with different flags could enable a use-after-free/UaF condition. To fix, the code now requires identical flags for sys_futex_requeue() (matching the behavior of old-style sys_futex() requeue). The vul...